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Abstract 


While progress is being made on integrating unmanned aircraft systems (UAS) into our national airspace 
on a broad scale, much work remains to establish appropriate certification standards and operational 
procedures, particularly with respect to routine commercial operations. This paper summarizes research 
to examine the extent to which today’s civil aircraft taxonomy applies to UAS, and, if needed, how that 
taxonomy could be amended to better cover different UAS designs and operations. Factors that shape the 
current taxonomy, as defined in the Federal Aviation Regulations, were assessed for applicability to UAS, 
potential incompatibilities were identified, and additional factors were proposed that might be useful for 
an updated aircraft taxonomy intended to cover UAS. The results suggest the possibility of constructing 
new groups in the taxonomy for UAS under a restricted category that share common airworthiness 
standards. Establishing distinct groups for UAS and associated standards that enable low risk operations 
for compensation or hire could be a timely step toward full integration. Such a step would allow the civil 
aviation industry and regulators to gain valuable experience with UAS while carefully controlling access 
and potential harm to the aviation system as a whole. 
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1. Introduction 


The unmanned aircraft systems (UAS) industry is projected to grow substantially in the near term, with 
respect to the number of UAS available on the market as well as the range of commercial capabilities 
[AUVSI-2013]. This vision of economic growth is consistent with the Federal Aviation Administration 
(FAA) Modernization and Reform Act of 2012 [FAA-Mod]. That legislation mandates, among other 
things, that the FAA develop a comprehensive plan to safely accelerate the integration of civil UAS into 
the national airspace system (NAS) by September 2015, and define acceptable standards for certification 
necessary to support integration. While progress is being made on rules for small UAS 1 , the FAA has not 
established certification standards or other regulatory requirements (e.g., crew qualification and operating 
procedures) for routine commercial operations [GUZ-2013]. 

For this paper, the term certification encompasses a broad gamut of processes that must be undertaken in 
order to comply with regulation, policy, standards, and oversight to ensure an acceptable level of safety 
and efficiency while operating in the NAS. Certification serves a critical role in achieving the aviation 
community's safety objectives [RTCA-TF4-1999], The certification challenge for integration of civil 
UAS into the NAS is to develop guidance and standards that ensure that UAS operations do not 
compromise the safety of other airspace users or the safety of persons or property on the ground. This 
paper reports research findings that help to addresses this challenge, with particular emphasis on 
classifying UAS for the purpose of allocating airworthiness standards. 

Most civil aircraft must comply with minimum design and performance criteria as specified in 
airworthiness standards. According to Title 14 of the Code of Federal Regulations [CFR], better known 
as the Federal Aviation Regulations (FARs), the term airworthy means, “...the aircraft conforms to its 
type design and is in a condition for safe operation” (Part 3, Section 5). Different types of aircraft have 
different airworthiness standards that cover topics including flight characteristics, structures, design and 
construction, powerplants, and avionics. Civil airworthiness standards for general aviation and transport 
category aircraft are specified in the FARs, while others are developed by industry standards 
organizations such as the American Society for Testing and Materials (ASTM). 

As reported in [CPWF-2010], limited consideration has been given to date to how airworthiness standards 
and regulations may be appropriately applied across all UAS and their operations. On one hand, UAS 
regulations should be no less demanding than those currently applied to comparable manned aircraft; on 
the other, they should not penalize UAS “by requiring compliance with higher standards simply because 
technology permits.” [ULTRA-D1.1] Research reported here aims to determine the extent to which the 
existing aircraft taxonomy and associated airworthiness standards can be applied to different UAS types, 
and if they fall short, how can they be amended to better fit. 

The research reported in this paper qualitatively tests the hypothesis that the taxonomy used today in the 
FARs for allocating airworthiness standards is appropriate for UAS if two conditions are met: (1) the 
existing aircraft classes and categories sufficiently cover UAS designs, and (2) corresponding standards 
would neither overregulate nor underregulate UAS. The first condition indicates that existing 
airworthiness standards apply to UAS if the attributes that distinguish existing aircraft classes and 
categories can also be used to differentiate UAS designs in a similar way, notwithstanding the need to 
address UAS unique attributes such as command and control links and ground control stations. The 
second condition implies that airworthiness standards associated with each aircraft class and category 
combination need to be appropriate to the level of risk posed by UAS. If the current taxonomy and 
classification factors do not adequately capture either distinct design attributes of UAS or unique 
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Small UAS are generally considered those that weigh less than 55 pounds and operate within visual line-of-sight. 



operational aspects that affect risk in different ways from conventionally piloted aircraft (CPA), then 
other factors and potentially other standards may be required. 

Testing this hypothesis relies on interpretation of the intent of the FARs. This paper should not be 
considered or used as an authoritative source for regulatory guidance, nor does it represent current or 
future US Government or FAA policy. Instead, this examination of aircraft classification factors is 
intended to highlight some of the UAS design attributes and operations that affect the definition and 
application of airworthiness standards. The aim is to support development of an effective and practical 
approach to UAS classification that facilitates routine approval of UAS for commercial operation in the 
NAS. 

This report is organized into 6 Sections. Section 2 describes the research scope and rationale for why 
aircraft classification is important for enabling routine access to the NAS, as well as terminology 
fundamental to a coherent discussion on the topic. The current aircraft taxonomy used for CPA in the US 
is described in Section 3. Sections 2 and 3 may be skipped for those familiar with civil certification and 
issues relevant to UAS. The next two sections contain an analysis of the current classification factors for 
CPA, and discussion of prospective factors for unmanned aircraft. In particular, Section 4 identifies the 
factors that underlie the aircraft taxonomy discussed in Section 3, evaluates the hypothesis that those 
factors are sufficient for UAS, and identifies gaps where the existing taxonomy may not be well-suited for 
UAS. Then, Section 5 discusses additional factors that may be considered for augmenting the current 
classification system. Section 6 provides a summary of work to date and shares some final observations 
regarding the possibility of classifying UAS within the current aircraft taxonomy and factors potentially 
useful for doing so. 

2. Background 

Existing FARs and associated policy and guidance serve as a reasonable starting point for research 
inquiry into UAS certification issues, especially given that design standards and regulations for UAS are 
expected to conform with existing certification frameworks [FAA-RM-2013, CAP-722, DVP-2009, 
EASA-EY013]. To properly frame this research, clarifying what classification and airworthiness mean 
within this context is important. 

2.1 Scope 

Certification requirements specific to aircraft, to airborne and ground-based systems and equipment, to 
operations within different airspace classes, and to pilots and other personnel involved in operating or 
managing aircraft are all covered in the FARs. In this paper, the primary focus is on certification aspects 
pertinent to airworthiness standards for aircraft and their constituent systems and equipment. According 
to FAR Part 3.5, airworthy means that an aircraft “conforms to its type design and is in a condition for 
safe operation.” As per [ICAO], airworthiness requirements account for the safety of not only the 
participants in the airspace system, but third parties and property, too. Airworthiness certification is one 
of several different certifications required for an aircraft to operate legally in the NAS. Examples of other 
required certifications include those for pilots, flight crew members, and mechanics. FAR Part 21 
specifies the basic procedures for civil certification of aircraft products and parts in the US, including 
those for airworthiness. 

Airworthiness spans the lifecycle of an aircraft, from initial airworthiness during design and production, 
to continued airworthiness during operations and maintenance. This paper only considers airworthiness at 
the design level. According to FAR Part 21.203, every civil aircraft that operates in the US must have a 
valid airworthiness certificate; and that certificate is issued when the aircraft conforms to an approved 
type design and is in a condition for safe operation (FAR Part 21.183). Per [FAA-RM-2013], all UAS will 
require design and airworthiness certification for civil operations in the NAS, except for some special 


2 



cases, such as small UAS with very limited operational range. Aircraft type design and performance 
standards for most CPA are provided in several parts of [CFR] (namely, Parts 23, 25, 27, 29, 31, 33, and 
35), and in industry standards for other aircraft such as gliders and light sport. These standards reflect 
general consensus on minimum design and performance requirements necessary for safe flight, and are 
derived from engineering judgment and experience, especially lessons learned from accidents and 
incidents. 

Three different certificates are relevant to airworthiness: a type certificate, a production certificate, and an 
airworthiness certificate. A type certificate is issued for a particular design of a civil aircraft, engine, or 
propeller insofar as it complies with applicable airworthiness requirements. The quality system used for 
manufacturing aircraft is addressed through production certification. A production certificate is issued to 
confirm that a manufacturer can produce duplicate products under an FAA-approved type design. For an 
aircraft with a type certification, information about production and maintenance must be provided to 
obtain an airworthiness certificate. An airworthiness certificate indicates approval that each aircraft, as 
built, complies with its type design and is in a condition for safe operation. As such, airworthiness is 
applied on an airframe-by-airframe basis, whereas the type design applies to all aircraft of that design. 
Flowever, the same airworthiness standards, such as those in FAR Part 25 for transport category airplanes, 
are the basis for both certificates. This paper focuses on the technical aspects of airworthiness at the 
design phase (i.e., type certificate). This paper does not consider issues related to production certificates 
or continuing airworthiness for individual aircraft, nor does it consider the particular legal and procedural 
issues involved in the certification process. 

While on the topic of certificates, it is important to note that airworthiness certificates may be issued as 
“standard” or “special”. Most commercial operations require a standard airworthiness certificate. Under 
a standard airworthiness certificate, an aircraft typically has relatively few operating restrictions. Special 
airworthiness certificates are more restrictive, typically including operational limitations on maneuvers, 
speed, number of passengers, activities undertaken, or where flights may be conducted. The classification 
system in the FARs maps each combination of aircraft class and aircraft category into one of these two 
types of airworthiness certificates. For example, light sport and experimental aircraft operate under 
special airworthiness certificates, while general aviation and transport aircraft typically operate under 
standard airworthiness certificates. Certificates that allow commercial operation for compensation or hire 
have more stringent requirements than recreational or other types of use, including requirements on levels 
of redundancy and fail-safe features to meet reliability requirements. In this study, the focus is on 
classification factors relevant to commercial operation of UAS, rather than recreational use. 

The scope of the research presented here is focused on safety-related risks associated with classification 
of UAS within the existing regulatory framework in the short term. Certainly, UAS design possibilities in 
the long term may far exceed those for conventional aircraft. Concepts such as fully-autonomous UAS, 
passenger aircraft without a pilot on board, reconnaissance or monitoring swarms, and hypersonic UAS 
were not considered in this research. Other considerations not specific to safety, such as privacy [GAO- 
2012], security, and environmental impact, were also not considered. Offering classification analysis for 
these advanced concepts, without sufficient data on the hazards they may introduce, is not warranted. 

2.2 Terminology 

This section explains the key terms used throughout the paper relevant to classifying UAS. To the extent 
possible, this paper uses terminology consistent with the FARs 2 and other FAA regulation and policy. 


2 The notation FAR Part X.Y is used throughout this paper when referring to specific regulations, and should be understood to 
mean “Title 14 of the Code of Federal Regulations, part X, section Y” [CFR], 
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• Airworthy: In civil aviation, airworthiness is specific to the aircraft; that is, the airborne vehicle. 
Most UAS comprise several distinct parts in addition to the aircraft, including a ground control 
station, command and communication links, and possibly launch and recovery equipment — 
physically separate from the aircraft. This paper uses the term airworthy to consider all 
components of a UAS necessary to enable safe flight from take-off to landing. 

• Class: “As used with respect to the certification of aircraft (i.e., aircraft class), means a broad 
grouping of aircraft having similar characteristics of propulsion, flight, or landing. Examples 
include: airplane; rotorcraft; glider; balloon; landplane; and seaplane”, (from FAR Part 1.1) 

• Category: “As used with respect to the certification of aircraft (i.e., aircraft category), means a 
grouping of aircraft based upon intended use or operating limitations. Examples include - 
transport, normal, utility, acrobatic, limited, restricted, and provisional.” (from FAR Part 1.1) 
[Note: The terms class and category are also referred to in the FARs for airmen ratings, including 
single engine, multi-engine, land, water, gyroplane, helicopter, airship, and free balloon. These 
definitions are not applicable to this paper.] 

The term classification is not defined explicitly in the FARs, although the term is used several times when 
referring to different aircraft types, airworthiness certificates, air traffic service routes, etc. For aircraft, 
class and category are used as attributes in combination to define a taxonomy that groups similar aircraft 
type designs with similar risk profiles for the purpose of assigning airworthiness standards. The physical 
and operational characteristics and capabilities that distinguish the aircraft classes and categories are 
referred to here as classification factors (i.e., those criteria that are used to determine class/category). 
Throughout this paper, the term group is used for the set of aircraft that fall in the same combination of 
class and category. Understanding the classification factors and how those may or may not apply to UAS 
is a primary objective of this research. 

Any discussion of classification and airworthiness standards must include a discussion of hazards and 
risks related to safety. Per FAA policy on safety risk management [FAA-8040.4A], a hazard is any 
condition that could foreseeably cause or contribute to an unplanned event or series of events that result in 
death, injury, or damage to, or loss of, equipment or property. A risk (in the safety sense) is the 
composite of the predicted severity and likelihood of the potential effect of a hazard that could cause 
harm to persons or damage to property. As an aside, safety has often been defined as “the absence of 
risk.” 

The terms above are used in this work in the context of CPA. Terminology specific to unmanned aircraft 
is less well established. Different terms have evolved over the years, including drone, unmanned aerial 
vehicle (UAV), as well as UAS, which is the term most-commonly used within the US today. This 
terminology continues to evolve: in a recent report from the ICAO, the terms remotely piloted aircraft 
(RPA) and autonomous aircraft are introduced as two distinct types of unmanned aircraft (UA) [ICAO- 
328]. As per the ICAO definitions, a UA is any aircraft intended to operate without a human pilot on 
board; an RPA is an aircraft where the flying pilot is not aboard the aircraft; and, an autonomous aircraft 
is an unmanned aircraft that does not allow pilot intervention in the management of the flight. The term 
system is commonly appended, (e.g., UAS and RPAS) to take into account associated support equipment 
such as a ground control station, command and control links, and launch and recovery equipment. This 
report uses the term UAS, and also adopts the term CPA ( conventionally piloted aircraft) to refer to 
manned aircraft, as recently used in other papers [ALPA-201 1, CPWF-201 1]. 

2.3 Civil and Public Aircraft Use 

Another important aspect of the civil certification context is the distinction between civil and public 
aircraft and their use as described in the FARs. The responsible regulatory authority and applicable 
regulations vary depending on who is operating an aircraft and its intended use. 
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Civil use refers to aircraft operated by an individual or company, for commercial purposes (e.g., 
scheduled air transport of passengers and cargo operated for compensation or hire) or private ones (e.g., 
for recreation or business purposes without selling services to the public). Radio-controlled model 
aircraft also fall under the umbrella of civil use for recreation, and are operated under the guidelines of 
[AC91-57], These guidelines do not restrict the aircraft (size, weight, etc.) or contain requirements 
regarding airworthiness. Instead, these guidelines restrict model aircraft operations to visual line-of-sight 
(VLOS), altitudes below 400 feet above ground level, day/visual meteorological conditions 1 , away from 
noise sensitive areas, and away from airports and other air traffic. A recent decision by an administrative 
law judge has questioned whether the current FARs can be used to regulate model aircraft, even when 
they are used for commercial purposes [NTSB-2014]. On June 25, 2014, the FAA released an 
interpretation of the special rule for model aircraft that addresses this ruling [FAA-20 14-03 96]. 

The FAA authorizes UAS to operate for some limited civil uses in the NAS today by issuing a special 
airworthiness certificate in the experimental category (FAR Part 21.191) or the restricted category (FAR 
Part 21.185). A special airworthiness certificate is issued to an aircraft that does not have a type 
certificate or does not conform to its type certificate but is in a condition to operate safely. Operation 
under an experimental certificate is typically done for research and development, flight testing, market 
survey, or crew training. Amateur-built, kit-built, or light-sport aircraft are also operated under an 
experimental certificate. Operating limitations and airworthiness standards are developed for each 
experimental aircraft to ensure the safety of other airspace users and persons and property on the ground. 
An important constraint is that aircraft operating under an experimental certificate cannot be operated for 
compensation or hire. [FAA-8130.34B] provides guidance for certification of UAS in the experimental 
category. UAS may also be authorized to operate for compensation or hire for some special purpose 
operations under a restricted certificate. As of June 2014, only two UAS with prior military certification 
have qualified for such operations. 

Public use refers to aircraft that are operated for governmental purposes, such as military operations, 
border patrol, law enforcement, firefighting, or scientific research. These aircraft are typically operated 
by local, state, or federal government agencies. An important difference between civil and public use 
aircraft is that public use aircraft cannot conduct commercial operations whereas several (but not all) 
categories of civil aircraft can. 

Airworthiness standards may differ depending on whether an aircraft is intended for civil or public use. 
Under [USC49-44704(d)], a civil aircraft operator must demonstrate compliance to the FAA’s 
requirements in order to receive an airworthiness certificate for their aircraft. Public operators provide 
their own assurance that their aircraft are airworthy. Public aircraft standards may be more or less 
stringent than civil standards depending upon individual mission requirements. Even though this paper is 
concerned with airworthiness standards for civil UAS, learning from airworthiness-related experiences of 
UAS in public service is important. Indeed, the bulk of the information that exists on safety -related 
hazards and design criteria for UAS comes largely from public use cases and thus, will influence the 
development of civil standards. 

Both civil and public aircraft are required to comply with FAA operational requirements (distinct from 
airworthiness requirements) to fly in the NAS. For most UAS (public and civil), operational approval 
comes in the form of a Certificate of Authorization (COA) or Waiver issued by the FAA [FAA- 
8900.227]. A significant number of UAS are operating in the NAS today under COAs. UAS may 
operate without COAs when operations remain within active warning and restricted areas, which is 
typically the case for military operations. 
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2.4 Standards-based Airworthiness Certification 


The primary purpose of airworthiness certification is to ensure that hazards and corresponding risks posed 
by the design, production, and continued operation of an aircraft are sufficiently mitigated. Risk posed to 
the NAS varies significantly depending on the type of aircraft, equipage, and its intended operation. For 
example, rotorcraft present some different physical hazards than airplanes due to aerodynamic design 
differences; whereas, a light sport airplane presents different operational hazards than a commuter 
airplane. FAR Part 21 and corresponding standards in Parts 23, 25, 27, and 29, provide an airworthiness 
certification framework that groups conventional airplanes and rotorcraft in a way that accounts for 
differences with respect to high level safety requirements and design considerations. As stated in 
[CPWF-2010], “A prerequisite to the realization of a viable civil UAS industry is the definition of an 
appropriate airworthiness certification framework for UAS. This framework must take into consideration 
the unique aspects of the technology, their operations, the market drivers, and the broader socio-political 
issues associated with the integration of a new aviation technology into society.” Routine access by UAS 
to the NAS implies that type design and airworthiness certification requirements for a UAS should 
mitigate risk to the same level (or better) as those required for CPA. 

Assuring compliance with the FARs as a primary means to certify the design of an aircraft could be called 
standards-based or prescriptive certification. A standard, consisting of minimum design or performance 
criteria that must be met, is typically established before an organization applies for type certification. 
Airworthiness standards include specific design criteria (e.g., structural load limits), required design 
features (e.g., existence of fire extinguishers), and performance parameters (e.g., required ratios of 
rotation speed to minimum control speed) necessary to mitigate known hazards and achieve an acceptable 
level of safety. Efficiencies in the certification process are gained by applying the same standards to any 
aircraft with a similar design and operational intent. 

Conceptually, standards-based certification is a straightforward process. An applicant: (1) defines a 
product, (2) establishes the product's applicable certification standards, based on the FARs, in 
collaboration with the certification authority, and (3) presents evidence that they have met the 
certification standards [AGF-2004, McCormick-2007]. The certification authority then evaluates this 
evidence for compliance. Benefits of standards-based certification include: (1) a priori knowledge of the 
expectations for certification, which facilitates planning from a design and cost perspective, and (2) 
establishment of a consistent and level playing field for all applicants. 

For most aircraft, the standards-based approach is used. Flowever, for aircraft that do not obviously fit 
into the conventional mold, certification authorities can establish appropriate criteria, as per FAR Part 
21.17b. A tilt rotor aircraft is an example of a novel design for which a standardized set of airworthiness 
criteria does not exist. The advantage of the FAR Part 21.17b approach is that it can accommodate any 
particular type design immediately, often leveraging relevant portions of existing standards, without 
waiting for the standards development process to take place. This approach is the only current alternative 
for UAS certification since airworthiness standards specific to civil UAS do not yet exist. The 
disadvantages of this approach are: (1) it is much more labor-intensive for the certifying authority; and (2) 
since all of the criteria are not known upfront, it is more difficult for the applicant and the regulator to 
plan for the cost of the certification effort given that there may be much more uncertainty in the outcome. 4 


4 In the US, costs associated with the involvement of regulators are not borne by the applicant. In Europe, the applicant must 
account for the involvement of the European certification experts. 
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2.5 The Role of Classification in Airworthiness Certification 


A standards-based approach to certification is desirable, if not essential, to achieve routine, versus case- 
by-case, access to the NAS for UAS. Classification supports this approach by providing a means for 
grouping aircraft together with similar design attributes (e.g., rotorcraft); but, less obviously and perhaps 
more importantly, grouping aircraft together that pose comparable safety risk and holding them to the 
same standards. More rigorous certification standards (e.g., calling for additional redundancy to meet 
reliability requirements) are levied on aircraft that pose a greater risk; whereas those that pose less risk are 
held to a lower standard (e.g., general aviation aircraft vs. light sport aircraft). Classification recognizes 
such differences in aircraft and the need for different standards. 

Because UAS differ from CPA in meaningful ways, these differences should be manifested in meaningful 
differences in certification standards, but not necessarily differences in the certification framework. For 
example, certification standards will be needed for UAS components such as ground control stations and 
communications functions related to aircraft control that do not exist with CPA. Including off-board 
systems and functions within the certification of UAS umbrella has been suggested for many years 
[Sabatini-2006]. Additionally, there are likely design differences among the wide range of UAS in 
existence today that would drive differences in required design criteria. For example, a “sense and avoid” 
function may be provided through an on-board system or it may be provided through a ground-based 
system. Although the function — sense and avoid air traffic — is the same for either approach, the 
airworthiness standards may vary depending on how the function is accomplished. In a similar way, a 
UAS that uses a beyond VLOS communications system may have different certification standards than 
one that uses VLOS communications. 

Classification supports risk reduction in at least two additional ways. First, it uses the notion of risk 
reduction through operational compensation. Some potential aircraft operations do not provide enough 
economic or other benefits to justify the expense involved in a standard airworthiness certification effort. 
Thus, these operations will not be conducted. However, other operations that do not derive their benefit 
through general access to the NAS may be restricted in a way that still retains the desired benefit, without 
adversely affecting the risk to the general public or other NAS users. This risk tradeoff is handled in the 
FARs through the restricted aircraft category. A restricted category aircraft is limited to special purposes 
identified in its type certification approval. This category is used for limited special purpose operations in 
manned aviation today, e.g., agricultural spraying and aerial surveying. The FAA recently invoked this 
category to approve limited commercial use of UAS in the Arctic for the first time [FAA-PR-2013]. 
Based on this premise, an agricultural UAS may be allowed to fly under operational restrictions similar to 
conventionally piloted agricultural aircraft. Furthermore, it may be possible to develop appropriate 
restricted certifications for other operations that are outside of normal air traffic routes and away from 
populated areas (e.g., pipeline monitoring, commercial fishing, etc.). At least in the short term, the 
restricted category may prove to be useful in the certification of UAS. 

The second way classification supports risk reduction is through the notion of certification compensation. 
FAA Advisory Circular (AC) 23.1309 describes how certification standards are lowered for avionics in 
some general aviation airplanes [AC23.1309]. The guidance was motivated by an assessment that low- 
time general aviation pilots have made mistakes that might have been prevented with advanced avionics, 
and therefore the avionics certification requirements are lowered to encourage greater equipage. 
Essentially, regulators concluded that the risk of a general aviation pilot with limited experience making a 
mistake is greater than the risk of the avionics failing or providing misleading information. The 
operational risk is mitigated through acceptance of an airworthiness risk, and by this assessment overall 
system risk is lowered. Using this approach for lowering certification requirements is controversial for 
UAS. On one hand, UAS have no people on board, thus acceptable risk may be judged inherently less (at 
least to participants). On the other, establishing that a UAS is equivalent in capability to a CPA is not 
trivial. The certification requirements in [AC23.1309] were only relaxed after detailed study, supported 
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by years of accumulating and analyzing safety-related data. Similar data will be critical to support 
appropriate certification standards for UAS. 

In summary, an important role of classification is to facilitate a standards-based approach to airworthiness 
certification of UAS. However, this can only be done by defining and applying classification factors that 
are sufficient for grouping together UAS with similar risk characteristics that would then justify similar 
airworthiness standards. 

3. Overview of the Civil Aircraft Taxonomy 

The aircraft taxonomy encoded in the FARs was developed over many years as new aircraft types came 
into the market and real-world issues — including technical, economic, and political issues — needed to be 
resolved. Aircraft weight is a key distinguishing factor between most categories within the CPA 
classification system and is a significant factor in overall risk to both people and property. However, a 
number of other considerations are also included in the aircraft taxonomy. 

In the FARs, CPA are divided into a few standardized groups based on a combination of their physical 
characteristics (i.e., aircraft class ) and operational characteristics (i.e., aircraft category). Together these 
determine the airworthiness standards that will serve as the starting basis for establishing minimum 
design criteria for type certification. Additional considerations, such as specific requirements for system 
reliability and design assurance levels, further divide these groups. The following section discusses some 
of the most relevant criteria for determining aircraft class and category, followed by a discussion of 
additional considerations. 

3.1 Aircraft Classes and Categories 

FAR Part 1.1 lists the following examples of aircraft classes: 

• Airplane 

• Rotorcraft 

• Glider 

• Balloon or Manned Free Balloon 

• Landplane 

• Seaplane 

The primary difference between classes is the means by which the aircraft achieves aerodynamic lift. In 
an airplane, lift is generated by the flow of air over the wings. If an aircraft gets its aerodynamic lift from 
rotating blades, including gyroplanes, the aircraft is classified as a rotorcraft. A balloon gets its lift due to 
buoyancy. Each means of lift generation requires different standards to maintain flight and mitigate the 
possibility of unexpected loss of lift. Landplanes and seaplanes are, for the most part, subsets of airplanes 
(in a physical sense), but because they have different landing characteristics and corresponding hazards, a 
different classification is required. 

Airworthiness standards for airplanes and seaplanes are given in Parts 23 and 25 of the FARs. 
Airworthiness standards for rotorcraft are found in Parts 27 and 29, and airworthiness standards for 
manned balloons are in Part 31. The FARs do not specify airworthiness standards for gliders; however, 
glider standards are available in [JAR-22]. For aircraft outside of these classes, such as a tilt-rotor, 
certification is handled on a case-by-case basis under the special provisions of FAR Part 21.17b. In the 
future if they become more prevalent, tilt-rotor aircraft may justify a new designated aircraft class in the 
FARs with corresponding standards. UAS and tilt-rotor may follow a similar path in this regard. 

Defining an aircraft’s intended use (i.e., aircraft category) is essential to discern the particular 
certification standards that apply to that aircraft and the type of operations that are allowed. Table 1 lists 



the aircraft categories with the intended use specified in the FARs, and identifies whether each category 
typically needs a type design certificate, whether it typically operates under a standard or special 
airworthiness certificate, and whether this category allows operations for compensation or hire. 


Table 1. Aircraft Categories, Use, and Certificate Types 


Aircraft 

Category 

Intended Use 

Type 

Certificate 

Needed 

Airworthiness 

Certificate 

Compensation 
or Hire 

Nonnal 

Nonnal flying (nonutility, non-aerobatic, or non- 
commuter operations) 

Yes 

Standard 

Yes 

Utility 

Flying with limited acrobatics allowed; e.g., spins 

Yes 

Standard 

Yes 

Acrobatic 

Acrobatics 

Yes 

Standard 

Yes 

Commuter 

Commuter operations: scheduled with at least 5 round 
trips/week with published flight schedules 

Yes 

Standard 

Yes 

Transport 

Regular public transport of passengers and/or cargo for 
hire or compensation 

Yes 

Standard 

Yes 

Restricted 

Special purpose operations, e.g., agriculture and aerial 
surveying (14CFR21.25) 

Yes 

Special 

Yes 

Primary 

Pleasure and personal use 

Yes 

Special 

No 

Light-sport 

Pleasure and personal use 

No 5 

Special 

No 

Limited 

Operation of surplus World War II military aircraft 
[FAA-8130.2G] 

No 

Special 

No 

Experimental 6 

Operation of novel or kit-built aircraft for evaluation, 
crew training, etc. ( 1 4CFR2 1.191) 

No 

Special 

No 

Provisional 

Operation of an aircraft that has not met all the 
requirements for a type and/or airworthiness certificate 
in another category (14CFR91.317) 

Yes 

Special 

No 


From a standards perspective, there is a general trade-off between operating limitations and rigor of the 
certification standard. Under a standard airworthiness certificate, an aircraft typically has few operating 
restrictions, beyond the flight rules captured in 14CFR91, 14CFR121, 14CFR125, and 14CFR135. 
Aircraft operating under a standard airworthiness certificate are held to a high standard commensurate 
with general operation in the NAS, including operation over populated areas. Special airworthiness 
certificates include operational limitations such as restrictions on maneuvers, speed, number of 
passengers, activities undertaken, and where flights may be conducted. Some standards for a special 
airworthiness certificate, compared with a standard certificate, may be relaxed as a result of the 
operational limitations. 

Operations for compensation or hire must comply with more stringent standards than operations for 
recreation or personal use. As shown in Table 1, most paid operations require both a type certificate and 
a standard airworthiness certificate. The restricted category is an exception. Restricted category aircraft 
can operate with a special airworthiness certificate for compensation or hire for a number of “special 


6 Light Sport Aircraft are not type certificated. Instead a statement of confonnance to industry consensus standards must be 
provided to the FAA (see [ASTM-F2245-12c]). 

6 Experimental is not listed as an aircraft category in 14CFR. It is included in Table 1 because its use is similar to the other 
categories listed. Some FAA sources refer to “special airworthiness certificate-experimental category.” 
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purpose operations,” specified in FAR Part 21.25, such as agriculture, aerial surveying, and banner 
towing. 

The aircraft categories in Table 1 that allow operations for compensation or hire are listed in Table 2 with 
key limitations with respect to weight and number of seats. As shown in Tables 1 and 2, aircraft 
categories are defined using a number of different characteristics. Weight plays a significant role, as does 
the number of seats. Flowever, other characteristics based on intended use also help distinguish one 
category from another. Maneuverability to support acrobatic maneuvers, frequency of flights, and 
whether those flights are scheduled are all factors. Different usage models, such as aerial survey and 
transport of passengers and cargo, also contribute to category distinctions. Each distinction in some way 
reflects differences in risk to the people on board the aircraft. 


Table 2. Description of Aircraft Categories and Key Limitations 


Aircraft Category 

Key Limitations 

Normal 

weight < 12,500 lb (airplanes) 

< 7,000 lb (rotorcraft) 
seats < 9, excluding pilot seats 

Utility 

weight < 12,500 lb 

seats < 9, excluding pilot seats 

Acrobatic 

weight < 12,500 lb 

seats < 9, excluding pilot seats 

Commuter 

weight < 19,000 lb 

seats < 19, excluding pilot seats 

Transport 

weight > 12,500 lb, seats > 9, (jets) 
weight > 19,000 lb, seats > 19, (props ) 
weight > 7,000 lb (rotorcraft) 

Restricted 

No operation over densely populated areas, in a congested airway, or near a busy airport. 
Passengers are not allowed in flights for compensation or hire. 


Table 3 relates each aircraft class and category combination that can be operated for compensation or hire 
to the FAR Part containing the airworthiness standards that serve as the starting point for type 
certification. 


Table 3. Starting Point for Type Certification for Aircraft Class/Category Combinations 


Aircraft Category 

Aircraft Class 

Airplanes 

Rotorcraft 

Acrobatic 

Part 23, with some regulations specific 
to acrobatic aircraft 

There is no acrobatic category for rotorcraft 

Normal 

Part 23 

Part 27 

Utility 

Part 23, with some regulations specific 
to utility aircraft 

There is no utility category for rotorcraft 

Commuter 

Part 23 

There is no commuter category for rotorcraft 

Transport 

Part 25 

Part 29 

Restricted 

Part 23 or 25 

Part 27 or 29 


10 





3.2 Additional Considerations 


Further criteria for classifying aircraft with respect to airworthiness are specified in other regulatory 
documents, such as FAA Advisory Circulars. Of particular relevance is [AC23.1309] on system safety 
analysis for Part 23 aircraft, which includes a description of four “certification classes of airplanes” within 
Part 23 7 , shown in Table 4. The fact that further distinctions are drawn for normal, utility, and acrobatic 
category aircraft is significant with respect to classification factors, particularly physical characteristics. 
For example, both airplane weight and number and type of engines are factors that ultimately affect how 
airplanes are grouped together with respect to type design criteria. 


Table 4. Influence of Weight and Engines on Classification 


23.1309 Class 

Normal, Utility, or Acrobatic Category 

Commuter Category 

23.1309 Class I 

Weight < 6000 lb 
Single reciprocating engine 

N/A 

23.1309 Class II 

Weight < 6000 lb 

Either multiple reciprocating engines or a turbine engine 

N/A 

23.1309 Class III 

Weight > 6000 lb 

Either multiple reciprocating engines or a turbine engine 

N/A 

23.1309 Class IV 

N/A 

Weight < 19,000 lb 
19 or fewer seats 


In Table 5, reliability and design assurance level (DAL 8 ) requirements are listed for each class mentioned 
in [AC23.1309], The classes specified in this table are particular to only one regulation specified in FAR 
Part 23.1309. More specifically, Classes I-IV do not apply outside of Part 23 airplanes, nor do they apply 
to any other regulations within Part 23. Parts 25, 27, and 29 all have similar standards for system 
reliability and design assurance, but do not have any subdivision similar to that in [AC23.1309], 


Table 5. Reliability and Design Assurance Requirements for 23.1309 Classes 


23.1309 Class 

Reliability and Design Assurance Requirements 

Minor 

Major 

Hazardous 

Catastrophic 

23.1309 Class I 

P/< 10' 3 
DAL = D 

P 7 < 10' 4 
DAL = C/D 

P/< 10' 5 
DAL = C/D 

P/< 10' 6 
DAL = C/C 

23.1309 Class II 

P/< 10' 3 

DAL = D 

P/< 10' 5 
DAL = C/D 

P 7 < 10' 6 
DAL = C/C 

P / <10‘ 7 
DAL = C/C 

23.1309 Class III 

P/< 10' 3 

DAL = D 

P 7 < 10' 5 
DAL = C/D 

P f < 10' 7 
DAL = C/C 

P ; < 10' 8 
DAL = B/C 

23.1309 Class IV 

P/< 10' 3 
DAL = D 

P/< 10' 5 
DAL = C/D 

P/< 10' 7 
DAL = B/C 

P / <10‘ 9 

DAL = A/B 


7 This use of the term class in the advisory circular has no relationship to the term described in section 3.1. 

s Design or development assurance level is the measure of rigor (denoted as levels A-E) applied to the design or development to 
limit the likelihood of errors occurring that have an adverse safety effect if they are exposed in service. [ARP-4754A] Level A 

is the most rigorous, corresponding to errors that have potentially catastrophic consequences, and Level E is the least. 
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The important point here with respect to UAS classification is that both airplane weight and the number 
and type of engines reflect perceived differences in the acceptable level of risk among non-transport 
category airplanes. From a standards-based certification perspective, the aircraft classes, categories, and 
additional considerations described above together define distinct groups of aircraft that can use the same 
airworthiness standards as a starting point for type certification. For example, a 23. 1309-Class III 
airplane typically would use Part 23 as a starting point for type certification, and must comply with a 10‘ 8 
target probability of failure for components whose failure could cause a catastrophic accident. 

4. CPA Classification Factors 

Using the descriptions of aircraft classes, categories, and additional considerations in the previous section, 
factors that distinguish CPA today can be identified, as shown in Table 6. Each factor relates either 
individually or in combination with others to aircraft-specific hazards or operational risks that are 
mitigated by means of the airworthiness standards. 


Table 6. Primary Aircraft Classification Factors from the FARs 



Aircraft Specific Factors 

Operational Factors 

Factors Supporting Class Distinctions 

Lift Generation 

Take Off and Landing Capability 


Factors Supporting Category Distinctions 

Weight 

Number and type of engines 
Maneuverability 
Number of passenger seats 

Scheduled operations 
Frequency of operations 
Motivation for use 
Responsible party 


Some individual airworthiness standards are tied to aircraft characteristics other than those in Table 6. For 
instance, an aircraft’s certificated maximum altitude is used to determine the requirements for the crew’s 
oxygen system (FAR Part 23.1441) or for a high-speed envelope in a normal category rotorcraft (FAR 
Part 27.87). Although these additional factors could be included in the analysis reported here, only 
factors used to make distinctions between aircraft class and category down to the level described in Table 
4 are relevant. The factors derived from [AC23.1309] are intentionally included here because design 
assurance and reliability are expected to be key certification considerations for UAS. Further, it is 
expected that UAS will require additional factors be considered, beyond those listed in Table 6. 

To support the analysis of the classification factors in Table 6, a short description of each factor and the 
partitions that it creates in the CPA design space are given below. 

4.1 Factor Descriptions 

Lift Generation 

Aircraft class is largely determined by how the aircraft generates lift. This factor partitions the design 
space of aircraft into three main classes: fixed wings (airplanes), rotating blades (rotorcraft), or lighter 
than air (balloons). One of the primary hazards for any aircraft is an unexpected loss of lift. Because 
different fundamental mechanisms are used to keep an aircraft in the air, different design standards are 
needed. That is, the design and construction standards necessary to ensure that a rotary wing aircraft can 
generate and maintain lift are different from those for fixed wing aircraft. The same is obviously true for 
balloons. 
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Take Off and Landing Capability 

The take-off and landing capability factor partitions the design space for CPA in two groups: those that 
are only capable of take-off and landing on land versus those that are capable of doing so on water. This 
distinction is applied only to airplanes and, as such, is more akin to a subclass distinction. Airplanes with 
these different configurations are susceptible to different hazards and require different mitigations to 
ensure safe flight and landing. Seaplanes, whether they are float planes or flying boats, have structural 
requirements not necessary for landplanes. These requirements include design and construction 
requirements for the airplane hull and floats to ensure that the seaplane is sufficiently buoyant to protect 
those onboard the airplane. 

Weight 

Maximum takeoff weight is the maximum weight at which the pilot of the aircraft is allowed to attempt to 
take off and is primarily determined based on structural limits. The FARs recognize that weight has both 
static and dynamic interactions with the aircraft structure and directly and indirectly influences 
controllability and performance to help assure safety of flight. Generally speaking, the severity of an 
incident or accident increases as the weight of the aircraft increases, since operational speeds also 
generally increase and the kinetic energy that must be dissipated in an accident increases. Another 
significant factor in risk exposure is that heavier aircraft tend to carry more people or more cargo. As 
such, weight is currently the primary factor used in defining a number of distinctions between aircraft 
categories, such as commuter category from transport, normal/utility/acrobatic from commuter, and Class 
I & II in [AC23.1309] from Class III. In recent years, questions have been raised as to whether original 
weight assumptions (and inferred risks) are still valid differentiators for determining airworthiness 
requirements given increased use of lightweight materials and advanced technology [ARC-Part23]. For 
this study, the following weight ranges are considered: (0-6000 lb), (6000-12,500 lb), (12,500-19,000 lb), 
and (> 19,000 lb) for airplanes, and (0-7000 lb) and (> 7000 lb) for rotorcraft. 

Number and Type of Engines and Propellers 

FAR Part 23 distinguishes aircraft performance, stability, and controllability requirements based on the 
number of engines along with their type, either piston or turbine, usually in combination with other 
factors, such as weight. In a similar way, [AC23.1309] partitions airplanes into subclasses partially based 
on the number and type of engines and assigns reliability and design assurance requirements based on this 
partitioning. This factor creates three partitions of the CPA design space expressly for airplanes: (1) 
single reciprocating engine, (2) multiple reciprocating engines or one turbine engine, and (3) multiple 
turbine engines. 

Maneuverability 

Aircraft intended to do acrobatic maneuvers require additional structural strength and controllability 
beyond that required for aircraft not intended for these maneuvers. Although listed here as a single factor, 
maneuverability is an amalgam of a number of parameters that influence structural strength and 
controllability. These include, for example, performance, stability, trim, stall, and spin characteristics. 
Maneuverability is used in the FARs in conjunction with other factors such as weight and number and 
type of engines to define three categories: normal, utility, and acrobatic. 

Number of Passenger Seats 

The number of passenger seats is a proxy for the potential number of people on board an aircraft. As the 
number of passenger seats (and hence passengers) increases, overall risk increases, and hence more 
stringent airworthiness requirements must be satisfied to mitigate that risk. In some ways this factor is 
related to the weight factor since an aircraft with more passengers implies an aircraft with a higher 
weight. The number of passenger seats generally partitions the CPA design space into one of three ranges: 
(0-9 seats), (10-19 seats), and (> 19 seats). 
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Scheduled Operations 

In FAR Part 110.2, a scheduled operation is defined as “any common carriage passenger-carrying 
operation for compensation or hire conducted by an air carrier or commercial operator for which the 
certificate holder or its representative offers in advance the departure location, departure time, and arrival 
location. It does not include any passenger-carrying operation that is conducted as a public charter 
operation.” This factor, coupled with frequency of operations, contributes to the distinction of commuter 
category from normal category. By itself, the fact that an operation is scheduled does not seem to have a 
significant effect on determining the applicable airworthiness standards, especially with respect to 
reliability and design assurance requirements. For this study, operations are considered as either 
scheduled or unscheduled. 

Frequency of Operations 

Frequency of operations is the number of times that an aircraft completes its intended operation over a 
defined period of time, and is most often measured on a weekly basis. For example, commuter operations 
are defined in the FARs as at least five round trips per week. This factor accounts in some sense for the 
risk of an accident on takeoff and landing. Because risk is greater for takeoff and landing than for any 
other phase of flight, more frequent operations require more stringent standards to achieve an equivalent 
level of safety in terms of accident rate. Two partitions of the CPA design space are considered with 
respect to frequency of operations: 0-4 operations/week, 5 or more operations/week. 

Motivation for Use 

Motivation for use is a factor that describes the general purpose for operating an aircraft. To a large 
extent, this factor distinguishes between private use (e.g., corporate jet operation) and operation for 
compensation or hire. It should be noted that not all operations by a company are considered 
compensated operations. Generally, if a flight operation is incidental to the business, then it is considered 
a private operation. However, private versus compensated use is not the only distinction in CPA 
classification. FAR Part 21.25 lists several specific operations that can be conducted for compensation 
under a special airworthiness certificate-restricted category. These include, for example, agricultural 
(spraying, dusting, seeding, and livestock and predatory animal control), forest and wildlife conservation, 
aerial surveying (photography, mapping, and oil and mineral exploration), patrolling (pipe lines, power 
lines, and canals), weather control (cloud seeding), and aerial advertising (skywriting, banner towing, 
airborne signs, and public address systems). Operation under a restricted certificate allows some 
relaxation of airworthiness standards by invoking operational limitations. Overall, the motivation for use 
factor affects airworthiness standards for CPA in the sense that standards are more stringent when the 
motivation for use is compensation or hire, versus private use. As such, two partitions of the CPA design 
space are considered for this factor: private operations and operations for compensation or hire. 

Responsible Party 

The responsible party is the person or organization responsible for the safe operation of the aircraft. If the 
operation is a private operation, then the responsible party is typically an individual or a private 
organization (whose primary business is not air travel). If the operation is for compensation or hire, then 
the responsible party is the one who holds the operating certificate. Different types of operating 
certificates allow different types of compensated operations (FAR Part 119), with the general notion that 
the requirements to obtain an operating certificate correlate to operational risk. For example, more 
requirements are levied on an operator carrying 20 passengers versus two passengers. With respect to 
aircraft classification, an aircraft used by a certificate holder performing a higher risk operation must 
comply with more stringent airworthiness standards. For example, standards for transport aircraft are 
more stringent than those for normal aircraft. For this factor, two partitions are considered: private 
carriage and common carriage. 
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In the following section, each of the factors described above are analyzed with respect to the original 
research hypothesis. 

4.2 Overview of Analysis Approach 

A proper taxonomy that accurately reflects the major risks associated with aircraft within each 
class/category combination can reduce the burden associated with tailoring standards through exemptions 
and special conditions. That notion is reflected in our research hypothesis: regulation as applied in the 
FARs for allocating airworthiness standards (for CPA intended for compensation or hire) is appropriate 
for UAS if two conditions are met: 

1. Existing aircraft classes and categories sufficiently cover UAS designs, and 

2. Standards associated with each class/category combination do not, when applied to UAS, 
overregulate or underregulate. 

The second condition assumes that existing standards would be appropriate for UAS if they place only 
necessary burdens on applicants or regulators to achieve a comparable level of safety to CPA in the same 
class/category combination. Testing the hypothesis relies on comparing the design space for CPA to 
UAS using each classification factor, and judging whether risk would be comparable for UAS and CPA in 
the same class/category combination. 

The first step in the analysis considers whether the design space partitions for CPA account for plausible 
UAS designs. That is, are there UAS designs that would not fit in any existing partition? For example, 
do most UAS fit in the airplane, rotorcraft, and balloon partitions per the lift generation factor? The 
design space of UAS may be a proper subset of the design space of CPA, or the design spaces of CPA 
and UAS may intersect to some degree. If the design space of UAS possesses elements not included in 
the design space of CPA, then there may be airworthiness risks in these UAS designs that are not 
mitigated by compliance with the standards. On the other hand, application of standards intended to 
mitigate risks that appear in CPA designs may overregulate UAS, if UAS do not share all of the same 
design attributes. This may occur if regulation is applied to mitigate a risk or control a hazard that does 
not exist in the UAS design. The simplest example of this is the seatbelt regulations required for CPA. 
Even though exemptions can be made for specious regulations, the exemption process burdens both 
regulators and applicants if the number and complexity of the differences are large. 

The second step in the analysis considers the degree of similarity in risk between CPA and UAS that 
share the same design partition. For CPA and UAS with similar type designs (share the same partition), 
this step examines whether risk associated with the UAS design or operations may be less or greater than 
that for CPA in the same class/category combination. If the risk is substantially less, then the standards 
could unnecessarily overregulate UAS. If the risk is greater, then the existing regulation may be 
inadequate. 

The analysis presented in the following subsections only considers factors that are used currently to 
distinguish risk, and hence standards among CPA. Admittedly, these factors may not be sufficient to 
capture all of the meaningful distinctions in UAS design or risks that should be covered by new or 
different airworthiness standards. As such, the following analysis is not definitive. Rather, it is 
qualitative and arguably speculative, and intended to provide useful insights about distinctions between 
CPA and UAS relevant to airworthiness standards. It is hoped that this analysis can help pinpoint 
dissimilarities that may be important in prescribing future standards for UAS. However, analysis results 
should be considered preliminary until sufficient data is collected to validate design and risk assumptions. 
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4.3 Analysis Results for Each Factor 

Two specific questions were addressed in the analysis for each classification factor: 

1. Does the range of factor x, as applied to CPA, adequately cover the UAS design space? That is, 
are there existing UAS designs that would not fall in any of the partitions for that factor? 

2. For UAS and CPA in the same design space partition for factor x, would the corresponding 
airworthiness standards likely apply to UAS without the possibility of over- or underregulation? 
That is, do UAS and CPA in the same partition pose similar risks to the NAS? 

Table 7 summarizes the answers to these questions. A “yes” answer to the first question indicates that the 
classification factor and its partitions include essentially all UAS types. A “no” answer indicates that 
there exist UAS types with design features or attributes that do not fit in any partition. Question 1 is 
relatively easy to answer for physical characteristics of the aircraft because information on actual UAS 
designs is readily available. Answering the questions for operational factors involves more speculation 
because UAS are not routinely operating for compensation or hire. There are more unknowns regarding 
how they will likely operate. For the second question, a “yes” answer indicates that applying the existing 
standards relevant to that factor to UAS seems reasonable. That is, credible counterexamples could not be 
formulated that would suggest otherwise. A “no” response to the second question indicates that a 
reasonable argument could be made that UAS and CPA of similar design types (within the same partition) 
might pose different levels of risk. As such, the airworthiness standards that correspond to that factor 
may either over- or underregulate UAS. In general, a “no” response to either question indicates the 
potential need for tailoring the partitions between class/category combinations or the airworthiness 
standards for a class/category combination, as related to that factor. Each factor is discussed below, along 
with rationale for the responses in the table. 


Table 7. Design Space and Risk Considerations for each Aircraft Classification Factor 


Classification Factor and Partitions 

Does this factor 
cover the UAS 
design space? 

For UAS and CPA in the 
same design space partition, 
do the corresponding 
airworthiness standards 
apply to UAS? 

Lift Generation: airplanes, rotorcraft, balloons 

Yes 

Yes 

Take-off/Landing Capability: Land, Water 

No 

No 

Weight 

airplanes: (0-6000) (6000-12,500) (12,500-19,000) (> 19,000) 
rotorcraft: (0-7000) (> 7000) 

Yes 

No 

Number & type of engines: 1 reciprocating, 1 turbine or multiple 
reciprocating, multiple turbines 

No 

Yes 

Maneuverability: nonnal, utility, acrobatic 

No 

No 

Number of passenger seats: (0) (1-9) (10-19) (> 19) 

Yes 

No 

Scheduled operations: scheduled, non-scheduled 

Yes 

Yes 

Frequency of operations: (0-4 operations/week), (> 5 operations/week) 

Yes 

No 

Motivation for use: private, for compensation or hire 

Yes 

Qualified Yes 

Responsible party: private carriage, common carriage 

No 

Yes 
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Analysis of Lift Generation 

Most UAS designs are similar to CPA fixed- or rotary-wing designs with respect to lift generation. This 
assertion is supported by Unmanned Vehicle Systems International (UVSI), who publishes an annual 
yearbook that catalogs UAS throughout the world and crossing many domains including law 
enforcement, commercial, military, and research. [UVSI-2013] Figure 1 shows the division of UAS listed 
in the 2012 and 2013 yearbooks, according to the primary FAA aircraft classes. Tilt-body, tilt-rotor, and 
flapping-wing aircraft are included under “Other.” 

As shown in the figure, only a small fraction (< 4%) of UAS would not fit in any class, as is true for CPA. 
Thus, the design space partitions created by this factor for CPA do reasonably cover the UAS design 
space. Further, for CPA and UAS of comparable size, the design and construction standards related to lift 
generation are likely agnostic to whether an aircraft has a pilot or passengers onboard. With this in mind, 
there is no obvious reason why existing design standards for lift would, if applied, overregulate UAS. 
However, a significant number of UAS, currently much smaller in size than CPA, have multi-rotor 
designs. For these, it is not clear whether existing standards for lift would be sufficiently stringent. 
Additional data on hazards and risks associated with multi-rotor UAS designs is needed. 



Aircraft Class 


Figure 1. UAS in Production in 2012-2013 According to Aircraft Class [UVS-2012, UVS-2013] 


Analysis of Take-Off and Landing Capability 

The design space for UAS, with respect to take-off and landing capabilities, encompasses more design 
options as compared to CPA. This is because UAS have additional options not practical for CPA. For 
example, some relatively small UAS use catapults for takeoff and nets for landing, while other UAS use 
arrested landings that would be hazardous for any CPA. Those capabilities would give rise to hazards and 
mitigation options different from those for CPA. Depending on the prevalence of those capabilities, new 
subclasses similar to landplane and seaplane may be warranted. 

Risks associated with takeoff and landing for UAS and CPA with similar take-off and landing capabilities 
may not be the same, especially with respect to risks related to harm to crew and passengers. 
Airworthiness requirements that protect the crew and passengers during takeoff and landing would 
possibly overregulate UAS. 
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Analysis of Weight 

Strictly speaking, the weight partitions for CPA listed in Table 7 cover the design space for UAS, since 
there is no minimum weight specified for either airplanes or rotorcraft. However, many UAS weigh 
much less than CPA. CPA designs must accommodate any people on board, in addition to the minimum 
equipment needed to comply with rules that govern their operation. Consequently, there is a practical 
minimum weight for CPA that is greater than many UAS. This is reinforced by a recent UAS market 
survey [UVSI-2012] that reports that approximately 80 percent of UAS airplanes weigh less than 500 lb, 
and roughly 82 percent of UAS rotorcraft weigh less than 500 lb, below what is practical for any CPA 
operating for compensation or hire. 

Applicability of the airworthiness standards that align with the weight partitions is a different matter. The 
weight of a UAS impacts the severity of an adverse event, such as a mid-air collision or impact with 
persons or property on the ground, just as weight does for a CPA. For UAS and CPA of comparable 
weight and design doing comparable operations, severity of the consequence of a failure could be similar, 
and application of the same standards seems reasonable. However, it is not clear whether the risk 
associated with a 60-lb UAS is necessarily comparable to that of a 6000-lb CPA, even though they are in 
the same weight partition. It is conceivable that the lower weight possibly equates in some circumstances 
to lower risk than for CPA. If this is true, application of the same standards could overregulate UAS. 
Additionally, lower weight could allow UAS maneuvers not possible for CPA, which might entail 
different risk than CPA. UAS designs, especially in the lowest weight partition, may be inappropriately 
regulated if standards are allocated based primarily on the current weight partitions used for CPA. 

Analysis of Number and Type of Engines and Propellers 

The three partitions that currently exist for number and type of engines typically used in CPA do not 
cover the range of design possibilities for UAS in either dimension (number or type). An obvious 
difference is in the number of engines used in some UAS. “Multi-engine” for a UAS could mean 10 or 
more engines in some long endurance designs, such as NASA’s Helios aircraft, or multiple rotors used to 
increase stability and maneuverability in hexacopters and octocopters. In addition, some UAS have very 
different engine types to meet unique mission requirements (e.g., mission times on the order of days or 
weeks). For instance, many UAS will be electrically driven, possibly with solar power or fuel cells as 
sources for electrical power, whereas other UAS may use hydrogen power sources. The variation in UAS 
designs with respect to engine and propeller utilization is much more extensive than for CPA. Those 
UAS outside of the CPA design space will likely require different minimum design standards. 

For UAS and CPA with similar designs with respect to engine number and type, it seems reasonable that 
the same airworthiness standards may apply. However, change of scale in aircraft size and corresponding 
size for engines or propellers could affect the risk associated with loss of thrust capability. Additional 
data on hazards and risks associated with multi-rotor UAS is needed. 

Analysis of Maneuverability 

Analysis of how maneuverability affects airworthiness standards is challenging given that many different 
aspects of existing standards are influenced by this factor (e.g., performance, controllability, stability, 
trim, stall, and spin characteristics). It is reasonable to assume that UAS designs will need to maintain 
some minimum level of maneuverability to safely operate, especially to avoid other aircraft and obstacles 
(i.e., vertical structures). However, it is unclear whether the current maneuverability criteria for normal, 
utility, and acrobatic aircraft are appropriate for UAS, or whether maneuverability should be used to 
partition the UAS design space for other reasons, such as the ability to meet minimum standards to avoid 
other air traffic. For UAS, it is not obvious if normal flying consists of similar operations to CPA, 
because what normal flying means is not well explained. As such, it is not obvious whether there will be 
a need for different structural and performance capabilities to support acrobatic maneuvers. What is clear 
is that many UAS designs currently are not comparable to CPA designs with respect to maneuverability, 
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some being much more maneuverable and some much less maneuverable. As a result, the CPA design 
space does not cover the UAS design space with respect to this factor. 

In general, for smaller CPA (i.e., not commuter or transport category aircraft), safety-oriented 
maneuverability constraints are aimed at protecting the pilot, crew, and passengers by protecting the 
integrity of the vehicle. For UAS, this need is no longer paramount, and thus risk mitigations appropriate 
for CPA could potentially overregulate UAS. 

Analysis of Number of Passenger Seats 

The CPA design space with respect to passenger seats trivially covers UAS which have no need for 
passenger seats at this time. Therefore, any requirement specific to seats would overregulate UAS; at a 
minimum there would be added burden associated with requesting an exemption. When passenger- 
carrying UAS are considered in the future, the effect of the number of passenger seats would become 
extremely relevant to risk and the need for corresponding design standards would need to be revisited. 

Analysis of Scheduled Operations 

It seems reasonable that UAS operations for compensation or hire could be grouped similar to CPA, as 
either scheduled (per a published schedule) or non-scheduled, overlooking the fact that the current 
definition of scheduled operations is specific to passenger carrying operations. From that perspective, the 
CPA design space covers the UAS design space. By itself, the fact that an operation is scheduled does 
not have a significant effect on design and performance standards, though it may affect continued 
airworthiness requirements. Generally speaking, scheduled operations for compensation or hire are 
expected to be more dependable than those that are not. It is not obvious that UAS would incur any 
different expectation. There are no obvious reasons why airworthiness standards relevant to scheduled 
operations would overregulate UAS design. 

Analysis of Frequency of Operations 

Clearly, the existing partitions for the frequency of operations, infrequent (less than five flights per week) 
versus frequent (five flights or more per week), do cover the UAS design space. The more interesting 
points concern the impact on risk due to differences in operational frequencies and the phase of flight that 
poses the most risk for UAS. UAS may operate on vastly different operational schedules due to 
significantly different operational capabilities. These may include both long endurance operations lasting 
days or weeks at a time, or super-short operations lasting only a few minutes. Standards that account for 
likelihood of failure based on assumed flight frequencies or flight durations may not adequately account 
for operational frequencies or durations that are significantly different from CPA. 

The frequency of operations factor accounts in some sense for the risk of an accident on takeoff and 
landing (i.e., the highest risk phases of flight for CPA). However, for UAS, it is not clear that takeoff and 
landing necessarily represents the highest risk phases of flight. It can be argued that a catastrophic event 
for UAS may be more likely during en-route or loitering phases of flight. In fact, for UAS that remain 
aloft for days, long duration loitering or operations involving in-flight refueling can dominate with respect 
to total risk exposure. Thus, CPA risks linked to frequency of flight considerations could be significantly 
different from those for UAS. This observation suggests further study regarding the suitability of existing 
standards when applied to UAS designs. 

Analysis of Motivation for Use 

The bifurcation of the design space based on motivation for use (private use or use for compensation or 
hire) covers UAS in the same way as CPA. This factor affects airworthiness standards for CPA in the 
sense that standards are more stringent when the motivation for use is compensation or hire. This is 
driven by the need to protect the flying public, whose personal safety is in the hands of the service 
provider. The “qualified yes” response in Table 7 indicates uncertainty about whether risks are different 
between private and compensated UAS operations. An argument could be made that societal 
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expectations for operation for compensation or hire would be the same regardless of whether the 
operation is manned or unmanned. A counter-argument could also be made that there is no substantive 
difference in hazards between operations for compensation and those that are for private use. In that case, 
existing standards based on motivation for use could potentially overregulate UAS. 

Two primary differences between CPA and UAS with regard to this factor, though, are the wider variety 
of UAS operations and the larger number of UAS types. For example, there are many UAS expected to 
operate close to the ground, in Class G airspace, doing utility type operations, such as crop surveillance, 
pipeline patrol, and wind turbine inspections. This is in contrast to most CPA (excluding some 
specialized uses of airplanes and rotorcraft) that tend to climb higher for efficient cruise to fulfill a 
transportation role. The important point is that many UAS will not need full or unconstrained access to 
the NAS to be commercially viable. This may lead to more opportunities for UAS to operate for 
commercial use under the restricted category than CPA. The degree of risk reduction possible by 
establishing operational limitations under a restricted certificate is much less for CPA than for UAS 
because there is always risk to human life for CPA. But this is obviously not the case for UAS. 

Analysis of Responsible Party 

The responsible party bifurcation for CPA into private carriage and common carriage covers the UAS 
design space. The concept that aircraft operated for common carriage should be held to a higher standard 
(at least for continued airworthiness) than aircraft operated for private use is expected to apply to UAS. 
Consequently, standards related to this expectation would not obviously over- or underregulate UAS 
designs. 

This factor, however, is more complicated than it may appear. The particular designations of operators in 
current use for CPA today (i.e., private carriage, common carriage, and subgroups, including commercial 
and air carrier) may not match well with UAS and how they are operated. That is, the entities responsible 
for the airworthiness of the aircraft and the safety of its operation may be different for UAS than for CPA. 

From a liability perspective, years of case law and legislation have defined the responsible party for CPA. 
Given the potential different operational modes for UAS, a similar legal process can be expected dividing 
liability between and among the customer, owner, operator, integrator, and manufacturer. 

4.4 Implications 

Analysis of the classification factors individually does not give a complete picture of how well the CPA 
design space relates overall to the current UAS design space, but it does expose some crucial differences. 
Several factors cover the design space well (e.g., lift generation and scheduled operations). Other factors 
and their corresponding ranges and partitions, however, do not adequately cover at least some aspects of 
the UAS design space that may be important to airworthiness. The following implications relevant to 
allocation of airworthiness standards were derived from the analysis results: 

(1) There are unique design attributes of some UAS (beyond communication links, ground control 
stations, aircraft detection systems, and launch and recovery systems) that are relevant to 
airworthiness, but that are not addressed in existing standards. Examples include UAS with catapult 
launchers, as well as quadrotor UAS. Additions to the existing airworthiness standards will likely be 
needed to mitigate new risks arising from such design aspects. 

(2) For some factors, such as weight, the existing partitions may not be adequate to accommodate 
significant differences in risks for UAS. Additional partitions for a factor (e.g., further divisions 
within the 0-6000-lb weight group) may be needed. For other factors, ranges will likely need to be 
extended, for example, increasing the number and types of engines and propellers. 

(3) The different designs and operational use cases for UAS suggest that care should be taken in applying 
existing standards to UAS in equivalent CPA partitions because overregulation, and in some cases 
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underregulation, may occur. In particular, airworthiness standards related to maneuverability 
(normal, utility, and acrobatic categories) merit attention. 

(4) Operational factors, such as frequency of operations, can potentially impact the level of risk posed by 
UAS that are similar in design to CPA. Consequently, application of existing regulation, without 
tailoring, has the potential to overregulate some UAS and underregulate others. 

Based on these observations, it seems reasonable to conclude that the aircraft classes and categories, as 
described in the current FARs, may not be adequate as is for many civil UAS designs. Existing aircraft 
class and category combinations do not fully cover the design space for current UAS. UAS are simply 
more diverse physically and operationally than CPA, as demonstrated by the examples in Section 4.3. 
Furthermore, the imposition of current standards, even in the case where UAS and CPA share similar 
design attributes (as per existing design partitions), could potentially overregulate some UAS and thus 
unnecessarily limit industry growth, or underregulate some UAS leading to insufficiently mitigated risk to 
the NAS. These findings do not discredit the current class and category definitions for CPA or approach 
to allocating standards, but do indicate that some non-trivial modifications likely are needed to fully 
accommodate UAS. 

This conclusion is consistent with other research findings that report significant differences between UAS 
and CPA, even within similar classes, to the extent that “using existing classification schemes as the basis 
for regulating the UAS fleet is unlikely to adequately account for these differences” [Palmer]. The 
conclusion is also echoed in the fact that several organizations, discussed in Section 5, have developed 
UAS taxonomies that do not rely solely on the current set of classification factors for CPA. As such, it 
seems reasonable to explore additional factors and contemplate if and how they might be useful in 
augmenting the taxonomy imposed by the FARs. 

5. Prospective UAS Classification Factors 

Over the past few years, organizations around the world have wrestled with the issue of UAS 
classification and regulation. Various taxonomies for UAS have been proposed, different from those used 
for CPA. Some are specific to airworthiness, others are used for allocating operational limitations, and 
still others comprise a combination of the two. Two surveys conducted independently by NASA [NASA- 
TM] and Modem Technology Solutions, Inc. in 2012 [MTSI-2012] describe many of those taxonomies. 
Both surveys served as sources for identifying additional factors that may influence how UAS could be 
classified. 

In the following subsections, prospective factors are described, and then examined to determine to what 
extent they could be used for UAS within the current taxonomy. A factor is useful in this regard if it 
extends the coverage of the UAS design space (i.e., beyond the current taxonomy), or if it defines an 
identifiable group of UAS designs that have similar operational risks. 

5.1 Factor Descriptions 

The factors listed in Table 8 were extracted from the various UAS taxonomies identified in the two UAS 
classification surveys [NASA-TM, MTSI-2012]. A few additions from the analysis summarized in 
Chapter 4 are also included. Some of these factors are similar to the current classification factors, and are 
listed in Table 8 as duplicative factors. The other factors are not currently used in making CPA 
class/category distinctions. 

For this study, the new factors are considered prospective factors for UAS classification within the current 
aircraft taxonomy. A brief description of each of these new factors, as viewed for this study, is provided 
below. Considerations and suggestions are made in Section 5.2 regarding appropriate values for 
partitioning the UAS design space based on these factors. 
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Table 8. Prospective UAS Distinguishing Factors 


Factors from Existing FARs 

New Factors 

• Weight 

• Lift Generation 

• Motivation for Use 

• LOS Operational Range • Airspeed 

• Frangibility • Kinetic Energy 

• Flight Time • Altitude 

• Aircraft Disposability/Cost • Operational Area 

• Avionics Complexity • Population Density Overflown 

• Degree of Autonomy • Operational Failure Consequence 


LOS Operational Range 

LOS operational range can have numerous interpretations. Here, LOS operational range refers to the 
maximum distance within which an aircraft can operate for a particular control mode. For UAS, this 
includes VLOS, radio line-of-sight (RLOS), and beyond RLOS (e.g., enabled by satellite 
communications). Although RLOS is usually greater in range than VLOS, this is not always the case. A 
UAS could have a remote pilot far away from the operation site, and have visual observers at the 
operation site who relay information to the remote pilot. In the context of this report, LOS operational 
range affects both the situational awareness of the pilot and the control mode of the aircraft. Within 
VLOS, the pilot or a visual observer can observe the aircraft and the surrounding environment; but, for 
operations beyond VLOS, all information about the flight must come from sensors. The control mode 
will affect the length of time between pilot observation, pilot action, and aircraft response. As this time 
increases, the pilot generally will have fewer responsibilities, while automated systems will have more 
responsibilities. 

Frangibility 

Frangibility is defined here as a design feature of an aircraft that allows it to break into pieces in order to 
mitigate and distribute the consequences of collision or impact. This feature may also be reflected in 
designs by use of a material or structure to absorb energy through deformation, thus minimizing injury. 
Frangibility is an attribute not normally seen in CPA as cockpit and cabin integrity is paramount. 
Although some parts of a CPA may be purposely designed to break away or break into pieces in case of 
certain failure modes, the notion of a completely frangible aircraft is unique to UAS. Frangibility was 
mentioned as a factor in recommended system standards for small UAS [SUAS-ARC]. As a design 
feature, frangibility may present some challenges with respect to conventional definitions for severity of 
accidents and incidents. 

Flight Time 

Flight time is defined here as the maximum time the aircraft can stay aloft without refueling or otherwise 
re-energizing. This factor captures the notion of endurance, that is, how long a UAS can fly “on its own.” 
For most UAS, this factor inversely relates to frequency of operations. When combined with airspeed, 
this factor also relates to LOS operational range. 

Aircraft Disposability/Cost 

Consideration of aircraft cost has no precedent in the FARs. As such, contemplating its use may be 
controversial. This factor is considered here because it captures a unique aspect of UAS risk: the risk 
deemed acceptable by the owner of a UAS relative to potential re-use or total loss of the aircraft. Aircraft 
cost can greatly influence design strategies for potential loss events. If an aircraft is designed to be 
retrieved or re-used after a mission, loss of control mitigation strategies will attempt to mitigate first-, 
second-, and third-party risk. For this discussion, first party risk is the risk incurred on the part of the 
UAS operator (i.e., the operational crew and vehicle itself). Second party risk describes the risk 
encountered by other parties using the NAS (i.e., other aircraft). Third party risk, which is not always 
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considered, encapsulates the risk incurred on the behalf of bystanders (i.e., people or properties on the 
ground). If a UAS is intended to be disposable, then only second- and third-party risk need be considered 
in mitigation strategies. As the cost of the aircraft increases in relationship to the limited liability the 
aircraft incurs with respect to second and third parties, mitigation strategies will shift to preserving 
aircraft integrity over preventing overall damage caused to other parties. Thus, UAS designed for use in 
unpopulated areas, second- and third-party risks may be minimal compared to cost incurred by the loss of 
the aircraft or its mission data. Cost also has a strong correlation with weight, performance, and 
complexity and thus might be a useful factor that combines many considerations into one. 

Avionics Complexity 

Complexity is a topic of frequent discussion in the avionics community, and particularly difficult to 
precisely define. The definition used here is the one identified in the survey; that is, an avionics system is 
considered complex “when its operation, failure modes, or failure effects are difficult to comprehend 
without the aid of analytical methods or structured assessment methods” from [AC 23.1309]. Examples 
of structured assessment methods include failure modes and effects analysis and fault tree analysis. The 
advantage of simple systems is that predicting behavior in failure scenarios is relatively straightforward 
and, presumably, sufficient mitigations can be developed to address these situations. Lack of 
transparency in complex systems, particularly with regard to inter-operability within and across 
subsystems, may lead to concerns about recognizing failure scenarios and developing mitigations. 
Consequently, complex systems may require more stringent reliability and design assurance levels to 
avoid failures and mitigate risk from unintended or unpredicted behavior. 

The definition of avionics complexity used here does not speak to the level of automation in UAS or the 
difference in the degree to which UAS depend on automation to attain and maintain safe flight as 
compared to CPA. In general, UAS are more dependent on the proper functioning of their avionics than 
CPA, primarily because a remote pilot relies on avionics to control the aircraft and to report aircraft state 
information. More of the avionics systems and functions in a UAS also may be considered “flight 
critical”, compared to CPA where many systems are deemed “for advisory use only” and the onboard 
pilot is responsible for determining whether and how to use the system. While these differences between 
CPA and UAS are important, a useful classification factor for possibly distinguishing one UAS from 
another was not obvious. 

Degree of Autonomy 

Degree of autonomy is not currently used to differentiate aircraft with respect to airworthiness standards, 
nor has it been addressed in a complete fashion by any of the literature on UAS classification surveyed to 
date. Autonomy, however, is often mentioned in discussions of UAS classification relevant to 
certification, and is listed here for that reason. An autonomous UAS, which according to ICAO is an 
aircraft that does not allow pilot intervention in the management of the flight [ICAO-328], is different in 
both design and operation and corresponding hazards and risks from remotely- or conventionally-piloted 
aircraft. As such, autonomy, or degree/level of autonomy, might seem like a relevant classification factor. 
However, how best to define and characterize autonomy, especially for use within a certification context, 
is still being debated. The analysis of the prospective factors in the next section does not include degree 
of autonomy because of this debate. Instead, some preliminary thoughts on autonomy as a potential UAS 
classification factor are given in Appendix A. 

Airspeed 

Here, airspeed is simply the velocity of an aircraft. Although airspeed is not a factor in the current CPA 
taxonomy, it is tied to several regulations, such as turn radii and closure rates with other aircraft. For 
UAS classification, airspeed is important primarily because of its role in kinetic energy, as per the kinetic 
energy factor, below. Many UAS are capable of safe flight at much lower airspeeds (and potentially 
lower kinetic energy) than most CPA. 
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Kinetic Energy 

Kinetic energy is used as a distinguishing factor in several of the UAS taxonomies identified in the 
surveys. Kinetic energy is a measure of the energy that an object, in this case an aircraft, possesses due to 
its motion, and calculated as the product of one-half an aircraft’s mass (m), and the square of its airspeed - 
(v), i.e., Vi mv 2 . The attractiveness of kinetic energy as a classification factor for UAS is that it can be 
viewed as a proxy for the amount of damage that can be inflicted on impact. 

Altitude 

Altitude, like airspeed, is a parameter whose definition is based on the context in which it is used. An 
aircraft’s altitude is typically measured with respect to mean sea level or local above ground level. 
Several airworthiness requirements, such as stability requirements, are dependent on altitude; but, altitude 
is not explicitly used for class/category partitioning for CPA. Altitude is used in slightly different ways in 
the various UAS classification schemes proposed to date. These include operational limitations such as 
maximum altitude and normal operating altitude. In all of the classification systems reviewed, altitude 
was coupled with weight and at least one other factor (e.g., airspeed or operational range). 

Operational Area 

The operational area factor distinguishes UAS based on the type of airspace where a UAS normally 
conducts its operations. In its most basic form, operational area partitions the design space into (1) areas 
where only UAS are allowed (i.e., “segregated”), or (2) areas where UAS mix with CPA (i.e., “non- 
segregated”). This factor does not represent a restriction on airspace usage for UAS. Rather, it defines 
categories with more and less stringent airworthiness standards. One can envision this factor using finer 
distinctions of airspace types, which may relate to the airspace classes A, B, C, etc. Operational area is 
not currently used to distinguish CPA class or category, except in the sense that standard type certificates 
do not generally contain operational area restrictions, but restricted type certificates may. 

Population Density Overflown 

Similar to operational area, population density overflown is based on what is underneath a UAS when it 
conducts normal operations. Concepts for partitioning the population density overflown are by populated 
and unpopulated, or densely populated and sparsely populated. There could be many more partitions 
provided viable measures of population density could be developed. This factor is not currently used for 
distinguishing CPA at the class/category level, but it is used as an operational limitation for a restricted 
category aircraft. 

Operational Failure Consequence 

While the other factors are specific to design, performance, or operational aspects, the operational failure 
consequence factor identifies particular hazards to be addressed. For example, the European Aviation 
Safety Agency (EASA) partitions UAS for certification purposes relative to two specific hazards: (1) loss 
of thrust leading to impact with the ground, i.e., “unpremeditated descent;” and (2) loss of control, under 
powered flight, resulting in impact with the ground [EASA-EY013]. EASA uses the aircraft’s kinetic 
energy associated with those two events to assign airworthiness requirements. 

In the following section, each prospective UAS factor is discussed with respect to its potential 
contribution to classification. 

5.2 Potential Contribution of Prospective New Factors 

The analysis in Section 4 showed that many UAS either do not fit well within the current classes or 
categories, or the airworthiness standards may not be appropriate because of significant differences in 
risk. The existing taxonomy could be improved to better fit UAS by either a careful refinement of current 
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CPA factors (e.g., modifying or adding new weight divisions), or by introducing new factors such as 
those described in Section 5.1 to capture relevant UAS risk dynamics. 

As with the factors in Table 6, some of the prospective factors in Section 5.1 are associated with design 
features of UAS and others are associated with operational aspects. Most of the operational factors are 
intended to mitigate some aspect of risk related to impact with other aircraft or impact with persons or 
property on the ground. To examine the potential contribution of these new factors to classification, each 
was placed into one of three types based on how they might distinguish one UAS design from another. In 
a few cases, a factor applies to more than one type. 

Type 1: Factors that account for novel UAS design features that present risks not addressed by CPA 

classification factors 

Type 2: Factors that mitigate impact severity or consequences 

Type 3: Factors that mitigate the likelihood or duration of an impact event 

The following discussion conjectures benefits, limitations, and ways that each new factor might be used 
within the current class/category taxonomy to support UAS. This discussion is not definitive, just as the 
list of prospective factors in Section 5.1 is not comprehensive. The primary intent is to call attention to 
some of the UAS design and operational attributes that can affect risk and associated design criteria and, 
hence, classification. 

5.2.1 Novel Design Feature Factors (Type 1) 

The UAS design space includes novel design features that can enable new behaviors and risk mitigation 
strategies not ordinarily used or possible in CPA. Frangible aircraft would be an obvious example. These 
designs are not covered in the current taxonomy represented in the FARs. Other factors that contribute to 
novel design attributes include LOS operational range, flight time, disposability, and avionics complexity. 

Discussion of LOS Operational Range 

As a design feature, LOS operational range can be partitioned into VLOS, RLOS and beyond RLOS. 
Within each partition, different means are needed to mitigate or recover from hazards. VLOS operations 
allow a human to directly provide “see and avoid” capability. Without this capability, remote pilots must 
use instruments to maintain situational awareness, and these instruments will rely on communication, 
navigation, and surveillance (CNS) systems, as well as information management systems to coordinate 
and present information. For VLOS operations, the aircraft may be at such a distance from the remote 
pilot that the state information provided by instrumentation provides a superior situational awareness than 
anything gleaned from visual inspection of the fielded vehicle. However, failures can be better mitigated 
by the remote pilot in VLOS operations, because an in situ judgment can be made regarding the 
overflown area and seriousness of an uncontrolled descent. For operations beyond VLOS, 
communication links become critical in the transfer of state data to the remote pilot. Communication 
li nks can be grouped relative to RLOS: within RLOS or beyond RLOS. In general, a communication 
system that operates beyond RLOS is more complicated (involving satellites or ground-based 
communication relays) and thus has more failure modes. Situational awareness is enhanced by visual, 
audio, and otolithic (vestibular and proprioceptor) cues, which can be simulated for remote pilots; 
however, these cues are difficult to reproduce without accurate vehicle attitude information. Thus, any 
failures have the potential to adversely affect situational awareness. 

LOS operation range as a type 3 factor affecting loss of control is discussed in section 5.2.3. 

Discussion of Frangibility 

Designing for frangibility opens up the airworthiness notion that the severity of an impact event can be 
mitigated by absorbing energy through the airframe and redistributing it through fracture. With no human 


25 



on board, it may be desirable in certain contexts to fragment the aircraft at or prior to impact, thereby 
limiting energy transfer and thus, collateral damage. For lightweight, maneuverable UAS, the impact 
severity is dominated not by aircraft weight, but by its overall ability to absorb and dissipate energy in a 
non-destructive or harmless manner (e.g., through plastic deformation or fracture mechanics). In that 
sense, frangibility offers the possibility of reducing the severity of a collision between a UAS and another 
aircraft or persons or property on the ground. However, this notion may also increase the probability that 
an impact event may result in the scattering of debris (which may still inflict harm), and scatter it farther 
away from the projected overflown area than desired. Evaluation of the factor for classification purposes 
must take into account the population density overflown and altitude of the UAS for a clear risk 
assessment to be performed. A frangible aircraft may need different minimum design criteria with respect 
to structures and materials than one that is not intended to be frangible. 

Discussion of Flight Time 

The flight time factor provides distinctions within the UAS design space for those UAS with significantly 
different endurance capabilities. The typical length of some UAS operations may be measured in 
minutes, while others may be measured in days or weeks. For example, for a UAS designed for airborne 
refueling, mission lengths (and total time in air between takeoffs/landings) may be significantly longer 
than for CPA. For such a UAS, frequency of flights will be low, but the exposure time to people and 
property in the air and on the ground will be very high. That suggests different risk profiles. Since UAS 
platforms need not land and take off with the frequency dictated by piloted vehicles 9 , maximum flight 
time, as a distinguishing factor, could serve a similar function for UAS as the frequency of flights factor 
does for CPA. In general, takeoff and landing are regarded as the phases of CPA flight with the highest 
risk. For UAS capable of remaining aloft for weeks, refueling operations and resolving maintenance 
issues will likely be the highest risk activities. With this in mind, flight time is likely a better 
distinguishing factor than flight frequency. 

Discussion of Aircraft Disposability/Cost 

Design for disposability is one possible strategy for mitigating potential impact events, for a UAS that is 
not intended to be recovered at the end of its mission. One can imagine operations in dangerous or toxic 
environments where the collection of data may be more valuable than the UAS itself. That aircraft may 
be considered disposable. UAS used to collect hurricane data is another example. If a disposable UAS 
has completed its mission, and undergoes an impact event resulting in its destruction, but with no other 
losses of life or property to any parties, then it may no longer be appropriate to term such an event as an 
‘accident’. Disposability strongly correlates with quality aspects of a UAS that affect safety risk (e.g., 
structural integrity and reliability), and may present different hazards and risks that may require design 
criteria different from non-disposable UAS. Disposability is just one aspect of cost that might affect UAS 
design. Aircraft cost will also affect aspects of airworthiness related to avionics complexity, component 
redundancy, system reliability, maintenance and lifecycle duration, structural and electronic integrity, as 
well as incurred liability. 

Discussion of Avionics Complexity 

In CPA, an avionics system that uses software or even slightly sophisticated hardware is considered 
complex. Using this standard, almost all UAS avionics designs will be considered complex; the main 
exception being a simple stick-to-surface radio-controlled UAS (e.g., radio-controlled model aircraft). As 
such, avionics complexity does not distinguish significantly between UAS designs. On the other hand, 
one could postulate a complexity metric and assign classification categories based on different levels of 


9 Pilots can remain in the air no longer than the times specified in FAR Parts 91.1057, 91.1059-1062. 
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complexity. While work is underway to develop suitable complexity metrics, challenges exist with this 
approach. 

The presumption for CPA, especially those carrying passengers, is that the pilot is in the best position to 
perform the correct action even in failure scenarios. As noted in section 5.1, complex avionics can hinder 
a pilot’s ability in a CPA to recognize failure scenarios and develop appropriate mitigations for them. For 
UAS that are expected to have more complicated avionics to compensate for the removal of the pilot from 
the cockpit, the ability to recognize failure scenarios and develop appropriate mitigations may be further 
reduced; but, the degree of that reduction is not clear. One can imagine that complex avionics with 
automatic failure recovery modes may be better at handling failures than a remote pilot with limited 
situational awareness. Additional data is needed to better characterize the relationship among automation, 
its complexity, and the impact of those on the ability of remote pilots to recognize and react to failure 
conditions. 

With the exception of avionics complexity, four of the novel UAS design factors can help distinguish 
UAS designs with different risk profiles that are not sufficiently differentiated by the CPA classification 
factors. This addresses the first implication drawn in Section 4.2. Table 9 summarizes how these factors 
could be applied to UAS within an aircraft class/category framework. 


Table 9. Applicability of Type 1 Factors for Novel Design Features to UAS Classification 


Prospective 

Factor 

Novel design feature 
or attribute 

Aspect of risk 
different from CPA 

Potential applicability to UAS classification 

LOS 

Operational 

Range 

Conventional flight 
deck functionality not 
on board the aircraft 

Loss of situational 
awareness 

Accounts for unique design features (VLOS, RLOS, 
beyond RLOS) that affect situational awareness given 
that remote pilots must maintain situational awareness in 
a different manner than in CPA. 

Frangibility 

UAS designed to 
disintegrate 

Severity of loss of 
aircraft integrity 

Acknowledges new safety-related design attribute that 
suggests need for different standards. Could be used to 
partition frangible from non-frangible UAS. 

May require work to define criteria for frangibility and 
recognition of frangibility as an acceptable attribute. 

Flight Time 

UAS that can remain 
aloft for very short or 
long periods (e.g., 
minutes, days, weeks) 

Time needed between 
maintenance checks 
(continued 
airworthiness) 

Identifies different norms in operational time that might 
suggest different standards. It could possibly replace the 
frequency of operations factor or modification of its 
partitions. 

Disposability/ 

Cost 

Cabin and flight deck 
integrity is no longer 
paramount 

Severity of loss of 
aircraft integrity 

Disposability may drive new safety-related design 
attributes that suggest a need for different standards. 
Could be used to partition disposable from non- 
disposable aircraft. 

May require work to define criteria for partitioning and 
recognition of disposability as an acceptable attribute. 

Avionics 

Complexity 

Remote control adds 
different dimension to 
complexity 

Reduced ability to 
detect or react to 
failures 

Questionable value as a classification factor, in part 
because of the difficulty in defining complexity. 


5.2.2 Impact Severity Factors (Type 2) 

For a UAS, which carries no passengers, the most significant risk is impact into densely populated areas 
or other aircraft. Airspeed, kinetic energy, and altitude all have two attributes in common with respect to 
impact severity. First, each factor relates to the energy that a UAS may have upon impact, either with the 
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ground, an obstacle (e.g., building), or another vehicle. Second, each of these factors can be used to 
restrict the severity of an impact event by means of operational mitigation. 

Of particular interest is whether Type 2 factors might be more appropriate for UAS classification than 
weight, and whether they can be considered in an independent fashion (as weight is currently). This 
connection allows exploration of the first implication in Section 4.4, that some current CPA classification 
factors may not possess adequate gradation to sufficiently partition the risks for UAS designs in the 
context severity of an impact event. In particular, the current breakdown of weight ranges is not well- 
suited for lightweight UAS systems, and may result in overregulating them. 

Discussion of Airspeed 

Airspeed limitations minimize the severity of the impact to other airborne objects and to people or 
property on the ground. Airspeed affects UAS operations in a similar way to existing CPA operations. 
However, design considerations with respect to UAS airspeed may be substantially different, because 
UAS may operate at speeds above or, especially, below speeds typical for CPA. Thus different minimum 
design standards may be required, considering the expanded operating envelop for many UAS. Further, 
airspeed is inextricably intertwined with the ability of an aircraft to detect and avoid surrounding traffic. 
Thus, the effect of this factor on discretizing the risk space with respect to impact severity will depend on 
context, in terms of maneuverability of the UAS as well as the nature of the overflown area. Finally, 
airspeed is a clearly defined and measurable parameter, which encourages its use in the determination of 
operational restrictions. Airspeed may also be a useful substitute for the weight factor, in terms of setting 
limitations to mitigate impact severity for lightweight UAS. 

Discussion of Kinetic Energy 

Kinetic energy is relevant to risk in that it can estimate the amount of damage that can be inflicted upon 
impact as a function of mass and velocity. In this regard, it can account for impact differences between 
UAS and CPA in a way that weight alone cannot. Kinetic energy measurements, however, are not 
straightforward. Kinetic energy can be computed using several different velocity types, and it can be a 
time-varying quantity throughout the flight of an aircraft. Therefore, kinetic energy may be non-trivial to 
accurately estimate for the purposes of determining design or operational restrictions. A more nuanced 
approach should be considered when contemplating a damage-related factor for UAS classification, as the 
total energy of any aircraft is dependent on the sum of its kinetic and potential energy (which is a function 
of altitude), and whether or not the collision is inelastic or elastic (frangibility). The population density 
overflown (e.g., densely vs. sparsely populated) also could be considered, because it directly impacts the 
potential severity of any impact event. Ultimately, replacing weight as a classification factor by any 
energy metric, including kinetic energy, could be challenging, especially in terms of assessment and 
enforcement. 

Discussion of Altitude 

Altitude contributes to impact severity in the sense that the potential energy of an aircraft increases as its 
altitude increases, hence severity of impact increases. Thus, altitude should be considered in conjunction 
with weight as it relates to impact energy, and is implicitly related to the population density overflown 
factor, in terms of assessing impact severity. While peripherally limiting total energy upon impact, 
altitude can provide for operational restrictions which limit the field over which the impact event can take 
place, as well as potentially acting to segregate CPA from UAS traffic. 

A clear point of interest is that none of the Type 2 factors can be considered independently when 
attempting to characterize the severity of impact of a UAS, unlike the weight factor. Table 10 
summarizes the assessment of the Type 2 factors in the context of mitigating severity of an impact event. 
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Table 10. Applicability of Type 2 Factors Aimed at Mitigating Impact Severity to UAS Classification 


Prospective 

Factor 

Does the factor alone 
distinguish between 
similar designs with 
different risks? 

Related factors for 
formulating 
operational 
restrictions to mitigate 
impact severity 

Potential applicability to the current CPA taxonomy 

Airspeed 

Yes 

Maneuverability, 
Overflown Area, 
Frangibility 

Airspeed could account for safety-relevant differences in 
airspeed norms between UAS and CPA. 

Maximum airspeed could be used to create partitions that 
bound severity of impact; or used to define different 
minimum standards for airspeed-related regulations. 

Kinetic 

Energy 

Yes 

Altitude, 
Overflown Area, 
Frangibility 

Kinetic energy could account for differences in impact 
severity between UAS (especially high speed, lightweight 
UAS) and CPA that cannot be realized by weight alone. 
Maximum energy could be used to create partitions that 
bound impact severity. 

Altitude 

Qualified Yes 

Overflown Area, 
Frangibility 

Questionable value as a classification factor, though it 
may relate to impact energy. 


As shown in Table 10, the nature of the operational area overflown (e.g., populated versus uninhabited) 
directly impacts the discussion of all three Type 2 factors. This observation is examined further in the 
next subsection, by investigating factors that provide a means to distinguish between similar UAS designs 
due to operational restrictions that limit the likelihood or duration of an impact event. 

5.2.3 Impact Exposure Factors (Type 3) 

Operational aspects are considered important drivers for risk in many of the UAS taxonomies in [NASA- 
TM]. Five factors from those taxonomies (LOS operational range, altitude, operational area, population 
density overflown, and operational failure consequence) relate to risks associated with exposure to an 
impact event. In this work, impact exposure refers to an amalgam of duration and likelihood of a 
hazardous event. If a UAS can successfully accomplish its mission in a limited operational area, then 
operational restrictions may sufficiently compensate for not meeting all airworthiness standards expected 
under a standard airworthiness certificate — allowing operation of the UAS without increased risk to the 
NAS. One could then imagine the creation of refinements of the current class/category taxonomy under 
restricted category. Sub-groups or sub-categories under the restricted category, each with their own 
minimum design standards, could facilitate the certification of UAS without extensive tailoring of design 
and performance criteria needed for standard airworthiness certificate. 

Discussion of LOS Operational Range 

As discussed in Section 5.2.1, VLOS, RLOS, and beyond RLOS operations represent unique design 
features that affect situational awareness different from CPA. This discussion focuses on LOS operation 
range from the perspective of risk associated with loss of control, specifically if a UAS loses radio contact 
and becomes uncontrolled by any human. If a UAS operation is taking place within VLOS, a visual 
observer can determine the actions of the aircraft and possibly ascertain whether the area of operation is 
populated; this may not be the case under RLOS operation. A UAS with a beyond-RLOS capability may 
have a complicated communication system (perhaps involving satellites or multiple ground-based 
communication relays) or may be capable of operation without human intervention (i.e., autonomous 
operation). Reliance on communication relays increases exposure because the relays introduce 
opportunities for commands or other messages to be lost, corrupted, or delayed, increasing the likelihood 
of an impact event. Additionally, communication relays may cause degradation in the quality of state 
information used to create relevant visual, audio or otolithic cues intended to enhance situational 
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awareness. Time delays inherent in RLOS and beyond RLOS operations can increase likelihood of a 
hazardous event in several ways: (1) the operator is unable to perform an action due to a delay in 
receiving state information, (2) the operator performs an incorrect action due to use of state information 
that is not up to date, or (3) the operator performs the correct action but it is not executed in a timely 
manner. This risk can be mitigated via additional design requirements (e.g., autonomous navigation 
capability, redundant communications, etc.) or through operational restrictions. Restrictions applied to 
LOS operational range directly influence the impact exposure of identical UAS; for instance, reliability 
and design assurance requirements may differ for the same UAS, depending on whether the UAS is 
restricted to RLOS operations or beyond RLOS. 

Discussion of Altitude 

Altitude by itself does not clearly drive unique design characteristics for UAS as compared to CPA. 
Certainly the presence of cloud cover affects the visual line of sight that can be maintained by a UAS, 
thus rendering the cloud ceiling as a potential operational barrier for VLOS maneuvers. However, this 
would not be dissimilar to altitude restrictions regarding the applicability of visual flight rules for CPA 
under clouded conditions. 

Instead, altitude is most useful for UAS classification from the perspective of operational mitigation via 
segregation of air traffic. For example, UAS may be restricted to operate below 400 feet, which provides 
segregation from other air traffic, since FAR Part 91.119 states that CPA should fly at least 500 feet 
above any obstructions in uncongested areas (1000 feet in congested areas). Because there is very little 
air traffic above class A airspace (approximately 60,000 feet), a UAS with an operational restriction to 
maintain an altitude above this level will effectively be separated from CPA air traffic. Furthermore, as 
discussed in Section 5.2.2, a UAS that experiences a loss of control at a higher altitude possesses a larger 
potential overflown area in which it can impact the ground. 

Discussion of Operational Area 

Certainly a UAS operating in segregated airspace would pose different risks than if it were operating in 
non-segregated airspace. Whether or not that would drive different design requirements, beyond 
minimum required equipment, is not clear. The value of creating airspace solely for UAS operations can 
only be assessed based on the operational context and intended use. If operational area is distinguished at 
a very high level, segregated versus non-segregated airspace, then the utility of the factor for UAS 
classification is questionable, given the goal of integration into the NAS. For CPA, operational area is 
used to limit operations for restricted category aircraft or other purposes (e.g., temporary flight 
restrictions). If restrictions on operational area for UAS are applied in a similar manner, this could be a 
transitional step for enabling UAS to participate in the NAS. 

Discussion of Population Density Overflown 

Population density overflown is one of the most prevalent factors used or proposed for use in UAS 
taxonomies. This is based on the fact that the risk posed by operating a UAS over an unpopulated area 
(assuming it could not go beyond that area) would be lower specifically with respect to harm to people 
than a CPA’s risk operating over the same area. In both cases, there is limited risk of harm to people on 
the ground; however, there is risk to people on board the CPA and no risk of such for the UAS. 

At the very least, reliability requirements could possibly be reduced for a UAS of consequential weight 
constrained to operate over lightly or unpopulated areas compared to a UAS without such a restriction. 
Population density overflown can be used to partition similar UAS designs based on whether or not the 
reachable impact area of the UAS is, at any time, populated. Population density overflown may be a good 
factor for representing risk to humans or property on the ground because it relates directly to likelihood 
and duration of impact risk. Such a factor would need to include the effects of power loss, lost link, glide 
potential, and such on reachable impact area. Like the operational area factor, this factor does not 
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represent a restriction on the areas overflown by a UAS. Rather, it defines groups that require more and 
less stringent airworthiness standards. 

Discussion of Operational Failure Consequence 

Operational failure consequences are used by EASA to group UAS for certification with respect to two 
major hazards: loss of thrust (i.e., unpremeditated descent) and loss of control (i.e., uncontrolled flight). 
EASA uses this factor in conjunction with kinetic energy to differentiate between UAS failure modes and 
associated risk. Because all UAS evince these hazards, design space partitions formed by the application 
of this factor do not aid in distinguishing between similar UAS designs, as the mechanisms for loss of 
thrust and loss of control may be very different given the wide range of possible UAS designs. A useful 
role for this factor in an aircraft taxonomy is not clear, and it may be better suited as a driver for designing 
mitigation strategies to alleviate risk. 

With the exception of operational failure consequence, the other four Type 3 factors identify operational 
profiles relevant to impact exposure that are not applicable to CPA risk. Specifically, the factors LOS 
operational range, altitude, operational area, and population density overflown provide a foundation for 
developing operational restrictions that could allow operational benefit for many conceivable UAS 
applications without increased risk to people or property in the air or on the ground. Table 1 1 
summarizes the assessment of the five type 3 factors that relate to impact exposure via the area in which 
the UAS is intended to operate. 


Table 11. Applicability of Type 3 Factors Aimed at Mitigating Impact Exposure to UAS Classification 


Prospective Factor 

Example of how this factor 
can mitigate impact exposure 

Potential applicability to the current CPA taxonomy 

LOS Operational 
Range 

VLOS provides increased 
situational awareness and 
responsiveness for the remote 
pilot, as compared to RLOS 

Could account for the hazard that an aircraft is fully 
functional but unintentionally uncontrolled by any 
human. 

Altitude 

Segregation of CPA from UAS 
air traffic 

Limiting a UAS’s altitude has questionable value as a 
classification factor. Instead, this factor is better suited 
as an operational restriction to mitigate impact exposure 
by segregating UAS from other aircraft. 

Operational Area 

Segregation of CPA from UAS 
air traffic 

Limiting the operational area to segregated and non- 
segregated has questionable value as a classification 
factor. Instead, this factor is better suited as an 
operational restriction to mitigate impact exposure by 
segregating UAS from other aircraft within range. 

Population Density 
Overflown 

Low population density or 
property value versus high 
population density or property 
value 

Could account for a lack of some hazards when 
operating over sparsely populated areas, compared with 
CPA. Potential during off nominal or loss of control 
events should be considered in addition to the expected 
operational area. 

Operational Failure 
Consequence 

None 

Questionable value for use as a UAS classification 
factor because it fails to distinguish between UAS or 
CPA. 


5.3 Implications 

While the current aircraft classes and categories may seem suitable for some UAS, as per Section 4, those 
classes and categories may not be appropriate as is for many credible UAS designs. This section 
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identifies factors that could act to cover UAS designs or facets of them not evinced by CPA, or to 
distinguish between similar UAS designs with different operational risk profiles. 

Table 9 identifies some novel design attributes common to many UAS that are not accounted for in the 
FARs. The novel design factors could act to distinguish UAS from each other, and facilitate standards- 
based certification through the development of minimum design and performance criteria to address the 
unique hazards or risks posed by these designs. The factors in Section 5.2.1 may not represent the best or 
only novel facets of the UAS design space, but they suggest that there are UAS design types that might 
benefit from explicit recognition of these attributes (e.g., frangibility, disposability, and flight time) 
within an aircraft taxonomy. Some of these factors could link different groups of UAS to individual 
standards in much the same way as is currently done for seaplanes, or others may lend themselves 
eventually to new aircraft categories. Additional data is needed to determine the necessity and particulars 
of any new standards needed to support these novel design attributes of UAS. 

Table 10 illustrates the use of factors aimed at mitigating the severity of impact events to resolve the UAS 
risk space more effectively than weight alone can. These factors could provide new ways to group UAS 
for risk mitigation. Though kinetic energy offers some advantages in accounting for the damage from 
impact with a UAS better than weight alone, it is not without its challenges as a classification factor. The 
use of a blended combination of factors, such as airspeed, weight, and population density overflown, may 
be more valuable for grouping most UAS designs with respect to operational risks. 

Perhaps the most important observation comes in Section 5.2.3. Table 1 1 shows that factors that control 
the exposure of a UAS to impact with other aircraft or people or property on the ground may provide a 
foundation for defining standardized groups of UAS based on operational restrictions. When coupled 
with factors that can limit impact severity, one could imagine that operational restrictions could be 
defined that correlate with practicable operational use cases (e.g., aerial surveillance for precision 
agriculture), similar to those called out already in FAR Part 21.25. The nuance here is that there may be 
sufficient numbers of UAS in each special purpose operation to justify the development of airworthiness 
standards specific to each. UAS, within those groups, could operate for compensation or hire without 
increasing risk to the NAS, and do so without the burden of extensive case-by-case tailoring of more 
rigorous standards (i.e., requiring numerous exemptions and special conditions). Grouping UAS by these 
operational factors to create further gradation of restricted category aircraft may be a promising direction 
to enable the certification and entry of specialized and operationally-restricted UAS into the NAS. 

6. Summary 

In the pursuit of enabling UAS to routinely access the NAS, much attention is being devoted worldwide 
to the challenges of developing UAS-specific certification processes, regulations, and standards, including 
those for airworthiness. These are essential to moving the process of integrating UAS into the NAS 
beyond the current practice of case-by-case accommodation. Notably though, there is an absence of 
consensus on what airworthiness standards should be and how they might apply across the diverse 
spectrum of UAS types. This paper is not intended to propose answers to those questions, but instead to 
provide insight into some of the numerous features and qualities of UAS that affect minimum design and 
performance standards. The research approach in this paper examines factors that shape the current civil 
aircraft taxonomy and the extent to which those factors apply to different UAS designs. 

This paper calls attention to several considerations that are relevant in the discussion of classification of 
aircraft types. Today, classification supports a standards-based approach to CPA certification, through 
airworthiness standards specifically tailored to the physical characteristics (class) and operational 
characteristics (category) of the aircraft; e.g., Part 25 for transport airplanes, and Part 27 for normal 
rotorcraft. This function of aircraft class and category neatly captures risk associated with design 
attributes of a particular type of aircraft, and also risk associated with intended use and operational 
limitations. Classification also supports risk reduction through operational compensation or through 
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certification compensations such as those for different subclasses of Part 23 airplanes. Altogether, the 
classification approach codified in the FARs and other regulatory policy represents a sensible and 
successful approach to mitigating airworthiness hazards in CPA with the efficiencies gained when a set of 
airworthiness standards can be applied to a significant group of aircraft types. This research examined the 
extent to which the existing approach to allocating airworthiness standards applies to different UAS types, 
and, if needed, how that system could be amended to better enable UAS to benefit from the application of 
common airworthiness standards. 

6.1 Applicability to UAS 

An obvious question is whether the current aircraft class and category taxonomy can accommodate the 
wide range of UAS design types and their desired range of civil operations. That is, is it reasonable to 
apply the existing airworthiness standards in the FARs to UAS that fall into the same broad class and 
category designations as CPA (e.g., normal airplanes, commuter airplanes, transport rotorcraft, etc.)? 
This study addresses that question, but with focus only on those aircraft classes and categories that 
support operations that could be conducted for compensation or hire. This research addressed that 
question by testing the hypothesis that the existing aircraft taxonomy is appropriate if the current classes 
and categories sufficiently cover UAS designs and if corresponding standards apply to UAS without the 
possibility of over- or underregulation. The hypothesis test proceeded by analyzing each of the factors 
and their corresponding breakpoints used to define the current set of aircraft classes and categories. 

The hypothesis test showed that the existing CPA classes and categories may be a reasonable fit for UAS 
that are indistinguishable in type design from CPA and operate in a manner similar to CPA under a 
standard airworthiness certificate. This assumes addition of standards necessary for the mitigation of 
hazards due to communication links, ground control stations, the distributed nature of command and 
control, electronic sense and avoid, and unusual launch and recovery systems. Flowever, that subset of 
the UAS design space does not represent the majority of UAS expected to enter the commercial market in 
the short term. That is, the aircraft classes and categories currently in the FARs may not be appropriate as 
is for many UAS designs intended for commercial use. The existing aircraft class and category 
combinations do not fully cover the physical and operational diversity of UAS. Further, the imposition of 
current standards could potentially overregulate some UAS and thus unnecessarily limit industry growth, 
and underregulate others, possibly increasing risk. These findings do not discredit the current taxonomic 
system for CPA or approach to allocating standards. These findings do, however, indicate that some non- 
trivial modifications likely are needed if full accommodation of UAS within a standards-based system is 
sought. This research effort examined one possible approach to doing that based on adding classification 
factors. 

6.2 Enhancements to Accommodate UAS 

This research investigated whether factors identified in UAS-specific classification schemes might be 
useful additions to those that define the current class/category taxonomy. Eleven prospective factors were 
identified and reviewed to determine whether they might distinguish UAS with different risk profiles. 
Several factors clearly account for risks associated with UAS-unique design features not applicable to 
CPA, such as frangibility, disposability, and long duration flight. New airworthiness standards for these 
features will likely be needed. 

Other factors used to mitigate operational risk, such as population density overflown, may be useful for 
grouping UAS based on restricted operational usage models. This finding suggests the possibility of 
constructing new groups for UAS under restricted category (i.e., restricted subcategories) that lend 
themselves towards the development of co mm on minimum design and performance standards for 
airworthiness. This differs from conventional certification practice for restricted category in that the 
starting type certification basis would be a set of standards expressly for that subcategory, not a case-by- 
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case tailoring of Part 23, 25, 27, or 29. The set of standards applied to a restricted subcategory of UAS 
could start with a pre-streamlined subset of Part 23, 25, 27, or 29 because the risk associated with that 
UAS group would be significantly less than the risk for CPA. Some combinations of the prospective 
factors, such as ffangibility, disposability, population density overflow, and altitude may actually render 
the consequence of an impact negligible (i.e., it no longer presents harm to other aircraft or persons or 
property on the ground). Restricted subcategories, based on those, could be defined where impact may no 
longer be the dominating influence on the risk profile, leading to a possibly small set of airworthiness 
requirements that would allow civil UAS operations in the NAS, however limited. Creating airworthiness 
standards at this level for UAS is not conventional, but could more quickly enable an emerging industry. 
This approach could provide a feasible path towards certification of UAS that could successfully operate 
under restrictions in the short term. 

6.3 Closing Thoughts 

The idea of having distinct groups for UAS tied to operational usage models is consistent with others 
advocating a step-wise process using restricted type certification [Allouche], and not far removed from 
the current COA process for public UAS. Establishing distinct restricted subcategories and associated 
standards that enable very low-risk UAS operations could be a timely stepping stone toward full 
integration. Such a step would allow the industry and regulators to gain valuable experience with UAS 
while carefully controlling access and potential harm to the aviation system as a whole. Identifying an 
effective set of classification factors and appropriate gradations of them is key to appropriately grouping 
UAS together that could share a co mm on set of design criteria. This paper supports the possibility of 
doing this in accordance with the framework governing manned aircraft as a way to enable standards- 
based airworthiness certification for UAS in the near term. Without question, significant issues would 
need to be resolved to realize such an approach (e.g., determining whether attributes such as frangibility 
and disposability would be acceptable or defining gradations for flight time that correlate to different risk 
profiles). 

This paper presents a small step in advancing the cause of UAS classification for civil airworthiness, and 
supports the possibility of classifying UAS within the confines of the aircraft taxonomy in the FARs. 
Additional research is needed to support decisions regarding a UAS classification approach that meets the 
needs of both regulators and applicants. Future research directions include a more comprehensive 
analysis of the prospective factors to better understand how they may characterize hazards and risks for 
UAS, with consideration of whether changes to the taxonomy might negatively impact CPA. Further data 
also is needed to better ascertain the hazards and risks associated with the breadth of UAS designs and 
operational models. 
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Appendix A: Autonomy 


Autonomy is not currently used to differentiate aircraft under 14CFR with respect to airworthiness 
standards, nor has it been addressed in a complete fashion by any of the literature on UAS classification 
systems surveyed. Autonomy, however, is often mentioned in discussions of UAS classification relevant 
to certification. Before considering autonomy as a potential classification factor for UAS, one needs to 
understand the myriad notions of autonomy and their implications on risk. This appendix takes a first 
step at providing context for an informed examination of the topic, specific to autonomous aircraft. 

Autonomy has been defined in different manners in diverse domains, such as robotics, artificial 
intelligence, and machine learning, leading to ambiguity in assessing which elements clearly characterize 
autonomy in the context of UAS certification. As certification is seen as a means by which risk to safety 
is mitigated, examining the aspects of autonomy that are unambiguously quantifiable and enforceable 
from a certification perspective is helpful. Thus, we first turn to formal definitions of autonomy, in the 
context of certification. 

A.l Definitions of Autonomy 

International Civil Aviation Organization 

Currently, ICAO defines 10 an autonomous aircraft as an “unmanned aircraft that does not allow pilot 
intervention in the management of the flight.” Furthermore, autonomous operation of an aircraft is 
defined as “operation during which a remotely-piloted aircraft (RPA) is operating without pilot 
intervention in the management of the flight.” Currently, ICAO only considers remotely piloted aircraft 
as suitable for standardized international civil operations, due to unclear responsibility for the autonomous 
portion of the flight [ICAO-328]. For the purposes of the paper, this definition is adopted, as this is an 
international regulatory agency, which prescribes regulation for flight across the globe. 

Note that this definition is binary in nature, and solely discriminates based on if a human can interact 
during the operation. This definition does not capture the notions of complexity usually encompassed in 
other definitions of autonomy, which address the nature of the environment as well as the difficulty of the 
task being performed. These two additional aspects to autonomy can be difficult to characterize, and pose 
several issues in terms of enforceability. However, other definitions, not constrained by enforceability, 
might provide information about scope and direction of advances in autonomy. 

Alternative Definitions of Autonomy 

There are many alternative definitions of autonomy, some of which do not consider autonomy to be a 
binary state. Ubiquitous amongst these is the seminal definition advanced by Sheridan [Sheridan], where 
the proposed role for humans in highly automated systems is to undertake what is called supervisory 
control. This is a new relation between the human and the machine, as an automatic machine may be said 
to be intelligent in some rudimentary sense. The new form of interaction differs from the traditional 
interaction of the human with tools and devices that possess no intelligence, in which all sensing and 
control are done by the human operator. In the Sheridan definition, each task can be performed with 
varying degrees of automation, and is resolved into a scale from (1) to (10), where level (1) corresponds 
to the situation where the computer offers no assistance to the human, and level (10) corresponds to the 
condition where the computer possess both full-decision-making functionality and the authority to enact 
these decisions without human input. Alternative academically-developed definitions of autonomy use 
different numbers of levels or scale the sensing (afferent) and the motor (efferent) functions separately 


10 ICAO provides this definition in a publication [ICAO-328] listed as a circular. Circulars are not official policy of ICAO. 
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[EndsleyKaber, WMW, SheridanVerplank]. The Federal Agencies Ad Hoc Autonomy Levels for 
Unmanned Systems Working Group in its first workshop, held in 2003, attempted to define metrics for 
autonomy and to develop a framework for autonomy levels for unmanned systems [ALFUS]. During the 
course of this and subsequent workshops, the autonomous operation of an Unmanned System (UMS) was 
defined as follows - Operations of a UMS wherein the UMS receives its mission from either the operator 
who is off the UMS or another system that the UMS interacts with and accomplishes that mission with or 
without further human-robot interaction. Autonomy was defined as a UMS's ability of integrated sensing, 
perceiving, analyzing, communicating, planning, decision-making, and acting/executing, to achieve its 
goals as assigned. A UMS’s autonomy is characterized by the missions that the system is capable of 
performing, the environments within which the missions are performed, and human independence that 
can be allowed in the performance of the missions. 

Unlike other organizations, NASA views autonomy as distinct from automation in accordance with its 
space initiatives. Automated systems provide control or execution of a system without human 
intervention or commands. This does not preclude the possibility of operator input, but such input is 
explicitly not required for an automated function [Constellation]. Autonomous systems are capable of 
operating independent of external communication, commands or control (i.e., commands from mission 
control on Earth). This definition allows the crew, but not mission control, to be involved in the operation 
of an autonomous vehicle. NASA also operates vehicles without an on-board crew, where the notion of 
autonomy is similar to other organizations. In these instances, the desire for autonomy occurs when the 
time delay between the vehicle and mission control is too large for the required dynamic maneuvers. This 
motivation for autonomy is quite different from the motivation for autonomy in UAS. 

In summary, all of these alternative examinations view autonomy on a spectrum rather than the binary 
approach of ICAO. Furthermore this spectrum can vary based on several different scales - (1) the amount 
of human involvement to perform a function, (2) the mission phase when human involvement is needed, 
or (3) the degree of sophistication in how the automated system accomplishes its function. In addition to 
adapting these definitions to the specific domain of aviation, refinement of these approaches must also 
occur for these gradations to be objective and enforceable for certification purposes. 

A. 2 Certification Issues with Autonomy 

The complexities inherent in the notion of autonomy yield a conundrum when it comes to the purposes of 
certification. It is difficult to construct clear, unambiguous language that allows for the assessment and 
enforcement of fundamental aspects related to autonomy [MEPW]. In the context of the ICAO definition, 
autonomy is cast as the capacity of an aircraft to operate in a real world environment without any form of 
external control for a given period of time. This allows autonomy to have a clear and enforceable 
definition, namely a system requiring no human input during its flight operation. However, there are 
subtle factors upon which this notion is dependent. The ability to use autonomy as a classification factor 
for UAS requires a fundamental understanding of the notion of autonomy and its implications on risk. 

How is human input defined? 

If the ICAO definition of autonomy is used, the issue of “human control inputs” needs to be defined 
clearly. To enforce a lack of human control input, operator qualification must be determined clearly, as 
well as authorizations for regimes of flight or functionality. For example, would an indication from a 
human operating a camera regarding a feature of interest be viewed, for purposes of certification, as a 
human control input? At an extremely high level, a software developer or mission designer can be 
considered to be an operator, which may cause unintended software consequences to be considered 
human inputs. Another complexity arises when autonomous aircraft interact with humans in the fielded 
environment (for instance to avoid or track humans). Presumably, at some level of interaction, a human 
in the environment becomes an operator. Objectively defining this point is quite subtle. 
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What is the impact of mission complexity on autonomy? 

The ICAO definition does not tie the idea of autonomy to mission goals. For example, a bullet is an 
autonomous system, using the ICAO definition, as it requires no further human control input after it is 
fired. To avoid these obvious corruptions of the term, it is natural to wish to include some notion of 
complex decision making to achieve mission goals into the definition. However, it is difficult to define, 
in an un-biased manner, what exactly a complex decision entails. Furthermore, defining an un-biased 
hierarchy, which allows for the ranking of decision types in order of increasing complexity, is a non- 
trivial task. There is no easily definable metric, which discerns the difficulty of a decision. Finally, it is 
unclear whether the measure of complexity should be informed by the difficulty of the goals being met, or 
the intricacy of the decisions being correctly made, that should inform. At a higher level, the primary 
purpose of aviation regulation is to maintain safety of the airspace. So, perhaps the definition of mission 
complexity should be limited to those aspects that affect the aircraft’s ability to maintain flight safety. 

How could the level of reasoning exhibited by an autonomous system be evaluated and certified? 

Many implementations of autonomous systems contain techniques that include a notion of reasoned 
decision making or “thinking.” The certification issues associated with these techniques are just beginning 
to be examined. Taxonomies for classifying reasoning abilities primarily hail from the machine learning 
or artificial intelligence domains [RussellNorvig]. These efforts attempt to compare the mechanized 
decision-making paradigms to those human behaviors they most closely mimic. However, mechanized 
decision-making paradigms are difficult to assess, and questionable to certify. An adaptive neural net 
may have an extremely intricate model of the world, and be able to aggregate percepts into highly 
complex notions of state, as well as successfully project the effect of many decisions on future states, but 
the means by which this process occurs can be ambiguous. The ability to pinpoint key points in the 
decision process and assess unambiguously defined metrics at these points to ensure safe and correct 
operation is critical to the evaluation and certification of any algorithm. The ability to document 
environmental assumptions, and assess when they are exceeded, in order to determine the operational 
ranges for which the algorithm performs correctly is vital to determine its safety. 

How should liability in the context of autonomous systems operation be established? 

The notion of autonomy has a specific legal meaning related to the right of an agent to choose freely its 
course of action. That is, autonomous agents possess a rule-of-self that is free from controlling 
interferences by others and from individual limitations that prevent meaningful choice [Black]. The 
degree to which these concepts apply to an autonomous aircraft is u nk nown. When an autonomous 
system fails, there are serious issues about who is liable as there are many stakeholders-the operator, the 
firm or agency that owns the equipment and/or employs the operator, the designer, the manufacturer, the 
installer, the maintainer, the regulator, etc. Notions of causality and foreseeability critically influence 
certification issues pertaining to autonomy, leading to a system possessing different degrees of autonomy 
under different operational conditions. This introduces the idea of variable autonomy, by partitioning the 
modes and areas of operation for autonomous aircraft. For example, a UAS can be highly autonomous 
during nominal operation or in particular regimes of flight but require further intervention during pre- 
determined off-nominal regimes. However, this presents certification challenges, as it involves issues of 
detection and mitigation that must occur concurrently. 

A.3 Implications of Autonomy 

The purpose of certification is to assess and provide assurance of the safety of a product or service. 
Regulation also is applied to protect people and property on the ground or on other aircraft who generally 
do not have a direct influence on the quality of the service being offered in the design and implementation 
stages. The safety of the aviation system evolves as systems are operated, flaws are discovered, and 
further advisories or regulations are created to eliminate those flaws. For the vast majority of regulation 
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developed for manned aircraft, there are corresponding hazards that are mitigated by these rules. 
Applying these rules to autonomous aircraft may not eliminate hazards that manifest themselves 
differently in an autonomous system. Research must be conducted to identify hazards, risk mitigation 
techniques, corresponding regulation and means of compliance for autonomous systems, to ensure that 
certification actually assures the overall safety of the NAS. 

A possible advantage of autonomy, from a safety and certification standpoint, comes from the idea of 
removing the pilot from the critical control loop, eliminating pilot error. However, the pilot also acts to 
mitigate and control off- nominal and hazardous situations. It is unclear how the creativity of the human 
in these problematic situations can be captured, and criteria developed to which all autonomous avionics 
should be certified in order to replicate this risk mitigation factor. 

Different techniques for implementing autonomy will have different challenges associated with 
certification. One key desire for an autonomous system is to handle rare or unexpected cases in a 
reasonable manner. The concept of “reasonable action” must be examined, and then defined in an 
unambiguous fashion, in relation to decision-making procedures as well as environmental and mission 
constraints for all foreseeable situations. 

Finally, if an autonomous system is certified on the basis that all actions taken by that system conform to 
a pre-defmed degree of reasonableness, and not correctness, then the effects of these decisions on the 
future state of the system need to be investigated. The cause-consequence analysis of a system whereby 
all behaviors are not certified as strictly correct, but rather as reasonable (i.e., minimize harm), is 
extremely intricate. Techniques for performing this analysis in a compactly expressible manner, for 
readability and reviewability issues, must be developed to certify these systems. Demonstrating 
compliance to certification criteria must be built in to any techniques developed for assessing these 
systems. 

Additionally, using the expanded notions of autonomy, which allow variable control of a UAS between a 
human operator and a computer, the authorized operator for the RPA must be clearly identified at any 
given time. This raises the question of whether or not this operator is uniquely determined at all times. It 
is possible for there to be an operational pilot (at a ground station) operating the aircraft, a safety pilot 
who is onsite with the aircraft, as well as a mission planner, inputting high-level goal changes for the 
aircraft, at any given time. Moreover, there may be several remote pilots, each dedicated to different 
regimes of flight. It is then difficult to declare that there is a single operator of the RPA, rather than a 
system of operators. Furthermore, an RPA is a highly cooperative human-machine system, and it 
behooves us to define the levels of human input commensurate with the responsibility that input entails. 
Furthermore, the protocols for handing off critical control functions between any of these operators 
amongst themselves, as well as to the RPA, must be defined clearly, and be specified in an enforceable 
manner. 

A.4 Summary 

The subject of autonomy, as concerns the certification of aircraft in a civilian airspace system, is fraught 
with many issues. Primary among these issues is developing the requirements for an autonomous system. 
Typically, the role of human operators is not well defined and an autonomous aircraft must perform all 
functions correctly whether they are written or not. Without clearly defined assessment techniques for the 
correctness of autonomous systems, under variable environmental conditions, it will be exceedingly 
difficult to create certification standards. The ability to define autonomy unambiguously and capture all 
of the necessary aspects associated with it in a measurable fashion is a non-trivial concept. There is a 
great need to further study measurable aspects of autonomy, as well as enforceable constraints and 
assumptions in the environment and mission goal parameters for autonomous systems. 
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Autonomy is significantly different from the other factors discussed in this paper. Currently, the full 
implications of autonomy in a civilian airspace, as well as its impact on overall safety, are u nk nown. The 
ability to regulate around a concept that is not yet clearly characterized will almost certainly lead to both 
overregulation and regulatory gaps. The ability to determine what aspects of autonomy impact the overall 
safety of a system is a topic of further research. Furthermore, the ability to assess the safety of an 
autonomous system (and ensure it maintains that safety under all conditions) is a topic of parallel 
research. Thus, while autonomy may be a critical factor for certification of a UAS, our present 
understanding of this factor is not yet at a level with which meaningfully certification characteristics can 
be derived. 
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